Technical impact
The vulnerability is improper authentication in Microsoft Spring Cloud Azure, allowing an attacker who is not authenticated to elevate privileges over a network. By bypassing authentication checks the flaw can give an attacker full control over the affected service, enabling unauthorized access, data tampering, or compromise of the application, categorized as CWE-287.
Affected Systems
Spring Cloud Azure deployments from Microsoft are affected. No version range is specified in the CVE data, implying that any installation that has not applied the vendor’s latest update could be vulnerable.
Risk and Exploitability
The CVSS score of 9 denotes high severity. An EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Attackers would need network access to the Spring Cloud Azure endpoints to exploit the authentication bypass, after which they could gain elevated privileges, potentially escalating to full system control.
