An attacker can upload a file of a dangerous type to Azure Orbital Spatio without restriction, enabling arbitrary code execution via the network. The flaw resides in the absence of validation or sanitization of uploaded content, the typical Weakness of Unvalidated File Upload (CWE‑434). The impact is the compromise of confidentiality, integrity, and availability of the affected system, allowing attackers to run arbitrary code remotely.

Microsoft Azure Orbital Spatio is the affected product. No specific version details are provided in the CVE entry.

The CVSS score is 10, indicating critical severity, and the issue is not listed in the CISA KEV catalog. Because no EPSS score is available, the exact likelihood of exploitation cannot be quantified, but the lack of upload restrictions suggests that an unauthorized attacker could trigger the exploit simply by uploading a malicious payload over the network.