Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code over a network, providing full remote code execution on the gateway device. This can compromise confidentiality, integrity, and availability of all traffic passing through the gateway.

Microsoft Azure Virtual Network Gateway is affected. No specific version information was provided, but the vulnerability applies to all currently deployed instances of the product at the time of the advisory.

The CVSS score of 9.9 indicates a critical severity and the vulnerability is exploitable by an attacker with valid credentials who can reach the gateway over the network. The lack of an EPSS score and absence from CISA KEV suggests no publicly known exploitation yet, but the high Severity warrants immediate attention. The flaw stems from CWE-20 improper input validation and can be exploited by crafting malformed packets that trigger arbitrary code execution. An attacker would need network connectivity to the gateway and must be authenticated or have privileged access to send malicious input.