CVE-2026-42823: Azure Logic Apps Elevation of Privilege Vulnerability
CVE-2026-42823 is an elevation of privilege vulnerability in Azure Logic Apps, rated Important by Microsoft, with a CVSS 3.1 base score of 9.9 (Critical). An attacker can exploit it remotely over the network, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.60% probability of exploitation activity in the next 30 days, higher than 49% of all scored vulnerabilities. Microsoft published it on 12 May 2026 in the May 2026 Patch Tuesday. It affects 1 product in 1 product family (Azure).
Key facts
- CVE ID
- CVE-2026-42823
- Severity
- Critical CVSS 9.9
- Microsoft severity
- Important
- Impact
- Elevation of Privilege
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-284
- EPSS
- 0.60% (percentile 49%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- May 2026 Patch Tuesday
- Product families
- Azure
From the May 2026 Patch Tuesday briefing
Azure Logic Apps Elevation of Privilege Vulnerability
At CVSS 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) with improper access control (CWE-284), this is a cloud-side EoP where an attacker needs some level of prior access (PR:L) but can then cross boundaries (S:C) to gain high-impact control. In practical terms, this fits a pattern seen in cloud incidents: a compromised low-privilege identity (developer token, leaked service principal, over-permissioned workload identity) is used to exploit an authorization flaw to escalate within the tenant or impact other resources.
From the briefing, written by an AI model from PatchaPalooza's data.
CVSS score and vector
Microsoft scores CVE-2026-42823 at 9.9 (temporal 8.6) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Changed |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.
Frequently asked questions (Microsoft)
What do customers do to protect themselves from the vulnerability?
Customers will be notified via Azure Service Health notification if they are impacted by this vulnerability. These alerts will include specific mitigation guidance and required actions for affected Azure Logic Apps resources.
Customers who have received an Azure Service Health notification for this issue can reference** Tracking ID:** 1P8-C0G in the Azure portal to review the applicable guidance and required remediation steps.
The Security Updates table for this CVE will be updated as additional information becomes available.
Additionally, customers who have subscribed to the Security Update Guide will be notified when this CVE is revised to reflect updated guidance or mitigation details. If you wish to be notified when updates are released, we recommend registering for security notifications to stay informed of content changes.
Affected products (1)
Azure
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Azure Logic Apps |
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 9.9 (CRITICAL)
- NVD weakness
- CWE-284
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| azure logic apps | all listed versions |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42823 (Vendor Advisory)
Acknowledgments
- Rajesh Chada with Microsoft
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |