Vulnerabilities

CVSS

9.9 Critical

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L/E:P/RL:O/RC:C

Risk score

79.2

Published

2025-05-08

Status

Published

Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.

Weaknesses

CWE-285

Coverage 1

vulnerability

Default Azure Automation Setting Enables Cross-Tenant Identity Takeover

A critical vulnerability in Microsoft's Azure Automation service, stemming from a default public configuration for automation account identities, could have allowed attackers to take over another tenant's identity and ac…

Dark Reading · Jul 24, 2026 Critical

CVE-2025-29827identitycloudautomation

All articles mentioning it

Advisories and references

• msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29827