CVE-2026-69419

Azure Data Manager for Energy Remote Code Execution Vulnerability

Published Aug 20, 2026 CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Description

Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.

Analysis

Technical impact

An integer overflow or wraparound flaw in Azure Data Manager for Energy permits an attacker who has authorized access to execute code over the network. The vulnerability arises when the system mismanages arithmetic operations and is classified as CWE-190.

Affected Systems

Microsoft Azure Data Manager for Energy is the affected product. No specific versions are listed, so all deployments of this product may be susceptible.

Risk and Exploitability

The flaw has a CVSS base score of 8.5, indicating high severity. EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, so known exploitation activity is unknown. The typical attack path requires valid credentials and network connectivity to the service, making it a network‑based exploitation for an authorized user.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Azure Data Manager for Energy

affected

Version	Status	Constraints
`-`	affected	—

Configuration 1 [-]

cpe:2.3:a:microsoft:azure_data_manager_for_energy:-:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Microsoft

Azure Data Manager For Energy

Version	Status	Scheme	Platform
`[0,*]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the security update for Azure Data Manager for Energy as soon as it is released.
Restrict inbound traffic to the service by permitting only trusted IP ranges or subnets.
Enforce role‑based access controls to limit who can invoke the affected API endpoints.
Monitor audit logs for unusual RPC or API calls that could indicate exploitation.

Generated by OpenCVE AI on August 21, 2026 at 01:06 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.742% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69419

History

Sep 4, 2026 7:15 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:microsoft:azure_data_manager_for_energy:-:::::::*

Aug 21, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 20, 2026 10:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.
Title		Azure Data Manager for Energy Remote Code Execution Vulnerability
First Time appeared		Microsoft Microsoft azure Data Manager For Energy
Weaknesses		CWE-190
CPEs		cpe:2.3:a:microsoft:azure_data_manager_for_energy::::::::
Vendors & Products		Microsoft Microsoft azure Data Manager For Energy
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69419
Metrics		cvssV3_1 `{'score': 8.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C'}`