Microsoft has disclosed an improper access control flaw in Azure Logic Apps, rated CVSS 10.0, that allows an unauthorized attacker to elevate privileges over a network with no authentication or user interaction.
What Is It
CVE-2026-83944 is an improper access control weakness (CWE-284) in Azure Logic Apps. Per Microsoft's description, the flaw "allows an unauthorized attacker to elevate privileges over a network." It was published on 2026-09-17 and currently carries an NVD vulnerability status of "Received," meaning the record is still awaiting full NVD analysis.
Why It Matters
The CVSS v3.1 base score is 10.0 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. Every exploitability metric is at its worst case: network-reachable, low attack complexity, no privileges required, and no user interaction; producing a maximum exploitability subscore of 3.9. The scope is Changed, meaning successful exploitation impacts resources beyond the vulnerable component's security authority, with High confidentiality and High integrity impact. Availability impact is rated None.
This CVE does not appear in the supplied CISA KEV data, so there is no confirmation of active exploitation in the source material, and no KEV-mandated remediation deadline or required action accompanies it.
What's Vulnerable
- Vendor: Microsoft
- Product: Azure Logic Apps
- Affected versions: listed as
-(all / not version-scoped)
Microsoft tagged the CVE exclusively-hosted-service, indicating the affected product is a cloud service rather than customer-installed software. No affected CPEs are listed in the NVD record.
Patch Status
No patch, workaround, or customer action is specified in the supplied data. Because the vulnerability is flagged as an exclusively hosted service, remediation is typically handled on the provider side; consult the Microsoft MSRC update guide entry below for authoritative status and any guidance Microsoft publishes.
Sources
- NVD, CVE-2026-83944: https://nvd.nist.gov/vuln/detail/CVE-2026-83944
- Microsoft MSRC Update Guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83944