Improper input validation in Azure Virtual Network Gateway, identified as a CWE‑20 flaw, allows an authorized attacker to execute code over a network, providing full remote code execution on the gateway device. This can compromise confidentiality, integrity, and availability of all traffic passing through the gateway.

Microsoft Azure Virtual Network Gateway is affected. No specific version information was provided, but the vulnerability applies to all currently deployed instances of the product at the time of the advisory.

The CVSS score of 9.9 indicates a critical severity and the vulnerability is exploitable by an attacker with valid credentials who can reach the gateway over the network. The EPSS score of < 1% indicates a very low probability of exploitation, but the high severity warrants immediate attention; the vulnerability is not listed in CISA KEV, suggesting no publicly known exploitation yet. The flaw stems from CWE‑20 improper input validation and can be exploited by crafting malformed packets that trigger arbitrary code execution. An attacker would need network connectivity to the gateway and must be authenticated or have privileged access to send malicious input.