CVE-2025-29827

nvd.nist.gov • July 25, 2026

Share: View original

Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.

View Analysis Description

Improper Authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Addresses Critical Azure Automation Vulnerability CVE-2025-29827 Microsoft has fixed a critical vulnerability in Azure Automation, tracked as CVE-2025-29827, which could allow authorized attackers to elevate privileges and access resources across Azure tenants. Discovered by Shay Shavit and reported in May 2025, the flaw has a CVSS score of 9.9 and stems from improper authorization in the service. Attackers could exploit this vulnerability remotely with low-level privileges, potentially impersonating other organizations' automation identities. Microsoft has updated the default configurations and recommends organizations to verify their Azure Automation accounts and permissions. The flaw could be combined with misconfigurations to cross trust boundaries between Azure tenants, posing a significant risk to sensitive cloud resources. Organizations are advised to apply the latest security updates and follow best practices to mitigate risks. 4 sources 71

Extracted Entities

Companies (1)

CVEs (1)

CWE Weaknesses (1)

CWE-862 - Missing Authorization