Microsoft has disclosed CVE-2026-50515, a critical (CVSS 9.9) deserialization of untrusted data vulnerability in Azure Service Bus that allows an authorized attacker to execute code over a network.
What Is It
CVE-2026-50515 is a deserialization of untrusted data weakness (CWE-502) in Microsoft Azure Service Bus. Per Microsoft's description, the flaw "allows an authorized attacker to execute code over a network."
The CVSS 3.1 vector, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, carries a base score of 9.9 (CRITICAL), with an exploitability subscore of 3.1 and an impact subscore of 6.0. Notable characteristics:
- Network attack vector with low attack complexity
- Low privileges required: the attacker must be authorized, but not highly privileged
- No user interaction needed
- Scope: Changed: impact extends beyond the vulnerable component's security authority
- High confidentiality, integrity, and availability impact
The record was published by Microsoft ([email protected]) and currently sits in NVD vulnStatus Received.
Why It Matters
The near-maximum 9.9 score comes from the combination of a changed scope and full CIA impact reachable by a low-privileged, remote, non-interactive attacker. The changed-scope rating indicates that successful exploitation affects resources beyond the security authority of the vulnerable component; the NVD record does not specify what that adjacent authority is, and the supplied material does not establish whether the impact reaches other tenants of the service.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation and no KEV-mandated remediation deadline or required action at this time.
What's Vulnerable
- Vendor: Microsoft
- Product: Azure Service Bus
- Affected versions:
-(no discrete version enumeration) - CVE tag:
exclusively-hosted-service
No affected CPEs are listed in the NVD record. The exclusively-hosted-service tag indicates the vulnerability exists in a Microsoft-operated cloud service rather than in customer-installed software.
Patch Status
Because Azure Service Bus is tagged as an exclusively hosted service, no customer-applied patch is enumerated in the supplied data. Microsoft's MSRC Update Guide entry is the authoritative reference for remediation status. No required action, mitigation, or workaround is specified in the source material provided.
Sources
- NVD, CVE-2026-50515: https://nvd.nist.gov/vuln/detail/CVE-2026-50515
- Microsoft MSRC Update Guide; CVE-2026-50515: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50515