The vulnerability arises from a missing authentication check in a critical function of Azure App Service for Linux, enabling an unauthorized network attacker to run arbitrary code on the host. This flaw permits remote code execution, compromising the confidentiality, integrity, and availability of affected services and potentially the entire hosted applications.

Microsoft Azure App Service for Linux instances are affected. Specific version information is not disclosed in the advisory.

The CVSS score of 9.8 indicates very high severity. EPSS data is unavailable, so the exploitation probability is unknown, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is remote network access to the vulnerable function without prior authentication. To exploit, an attacker would need to send crafted requests to the exposed endpoint, and the missing authentication allows direct code execution.