A path traversal flaw in Microsoft Azure Logic Apps lets an unauthenticated remote attacker elevate privileges across a security boundary, earning the maximum possible CVSS v3.1 base score of 10.0.
What Is It
CVE-2026-70200 is an improper limitation of a pathname to a restricted directory, a classic path traversal, in Azure Logic Apps. Per Microsoft's advisory text, the flaw "allows an unauthorized attacker to elevate privileges over a network." Microsoft ([email protected]) is the assigning source and published the record on 2026-09-17; NVD still lists it in Received status, meaning secondary analysis is not yet complete.
The record carries two weakness classifications: CWE-22 (path traversal) and CWE-285 (improper authorization).
Why It Matters
The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, producing a base score of 10.0 (CRITICAL), with an exploitability sub-score of 3.9; the maximum. Every precondition an attacker would normally need is absent: the attack is reachable over the network, complexity is low, no privileges are required, and no user interaction is needed.
The scope is CHANGED, meaning successful exploitation impacts resources beyond the vulnerable component's own security authority. Confidentiality and integrity impacts are both HIGH; availability impact is rated NONE. That scoring is consistent with data disclosure and data tampering rather than a service outage, though the record does not specify which boundary the scope change crosses or what resources sit on the other side of it.
No CISA KEV entry was supplied for this CVE, so there is no confirmation of active exploitation in the wild and no KEV-mandated remediation deadline at this time.
What's Vulnerable
The affected product list names a single entry: Microsoft Azure Logic Apps, with the version field recorded as - (all). No CPE match strings are published in the record.
Microsoft tagged the CVE exclusively-hosted-service. This tag is applied to vulnerabilities in cloud services that Microsoft operates directly.
Patch Status
The only remediation reference in the record is Microsoft's MSRC update guide entry. No patch version, KB number, workaround, or required-action text is present in the supplied data. Administrators should consult the MSRC entry directly for current guidance and to confirm whether any customer-side action is required.
Sources
- NVD, CVE-2026-70200: https://nvd.nist.gov/vuln/detail/CVE-2026-70200
- Microsoft MSRC Update Guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70200