Microsoft disclosed a maximum-severity flaw in Azure Billing where insufficient verification of data authenticity lets an unauthenticated attacker escalate privileges across a network boundary.
What Is It
CVE-2026-62874 is an insufficient verification of data authenticity vulnerability (CWE-345) in Microsoft Azure Billing. Per the NVD record, the flaw "allows an unauthorized attacker to elevate privileges over a network." The CVE was published by Microsoft's security response team ([email protected]) and currently carries a vulnerability status of "Received," meaning NVD analysis is still pending.
Why It Matters
The CVSS v3.1 base score is 10.0; CRITICAL. The vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L describes the worst-case exploitability profile: network attack vector, low attack complexity, no privileges required, and no user interaction. The exploitability subscore is 3.9, the highest the metric allows.
The scope is CHANGED, which is what drives the score to 10.0; successful exploitation impacts resources beyond the vulnerable component's security authority. Confidentiality and integrity impacts are both HIGH; availability impact is LOW (impact subscore 6.0).
There is no CISA KEV entry supplied for this CVE, so there is no confirmation of active exploitation in the wild at this time.
What's Vulnerable
Microsoft Azure Billing. The affected version is listed as "-", and no CPE match data is present in the record.
Critically, Microsoft tagged this CVE as exclusively-hosted-service. That tag means the vulnerability exists only in a Microsoft-operated cloud service; there is no customer-side software to inventory, scan, or patch.
Patch Status
No remediation action is specified in the supplied data, and no KEV due date applies. Because this is an exclusively-hosted-service vulnerability, mitigation is handled on Microsoft's side of the shared responsibility model. Customers should consult the MSRC update guide entry for any service-side advisory, disclosure timeline, or confirmation that the fix has already been deployed.
No patch versions, build numbers, or workarounds are listed in the source material.
Sources
- NVD, CVE-2026-62874: https://nvd.nist.gov/vuln/detail/CVE-2026-62874
- Microsoft MSRC Update Guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62874