CVE-2026-32171: Azure Logic Apps Elevation of Privilege Vulnerability
CVE-2026-32171 is an elevation of privilege vulnerability in Azure Logic Apps, rated Important by Microsoft, with a CVSS 3.1 base score of 8.8 (High). An attacker can exploit it remotely over the network, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.44% probability of exploitation activity in the next 30 days, higher than 39% of all scored vulnerabilities. Microsoft published it on 14 April 2026 in the April 2026 Patch Tuesday. It affects 1 product in 1 product family (Azure).
Key facts
- CVE ID
- CVE-2026-32171
- Severity
- High CVSS 8.8
- Microsoft severity
- Important
- Impact
- Elevation of Privilege
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-522
- EPSS
- 0.44% (percentile 39%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- April 2026 Patch Tuesday
- Product families
- Azure
CVSS score and vector
Microsoft scores CVE-2026-32171 at 8.8 (temporal 7.7) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.
Frequently asked questions (Microsoft)
What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain administrator privileges.
How could an attacker exploit the vulnerability?
An attacker could create a forged authentication token and use it to access administrative function APIs. This may allow them to retrieve keys, access the file system, and deploy unauthorized code within the Logic Apps environment.
How do customers mitigate this vulnerability?
Customers are protected through service-side (control plane) updates, which are automatically applied—there is no download, build number, or manual update required to receive the fix.
The only exception is for existing Logic Apps that were created when WEBSITE_AUTH_ENCRYPTION_KEY was configured as an environment variable. For those existing apps, customers must make a small update (edit any environment variable) to trigger the change and fully mitigate the issue.
New or updated Logic Apps already use a secret reference for the auth key and are automatically mitigated without any customer action.
Affected products (1)
Azure
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Azure Logic Apps |
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 8.8 (HIGH)
- NVD weakness
- CWE-522
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| azure logic apps | all listed versions |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32171 (Vendor Advisory)
Acknowledgments
- Nick Wojciechowski
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |