CVE-2026-42823

—

CVSS 3.1

9.9 critical

EPSS

<1%p47

Published

May 12, 2026 (May 12, 2026)

Modified

Jun 17, 2026

Description

Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.

Vendors: microsoft
Products: azure logic apps
Weakness: CWE-284
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news2 stories

Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws

The Hacker NewsMay 15, 00:00 UTC · May 15, 2026Vulnerability in the wildCVE-2025-54518 CVE-2026-41096 CVE-2026-42826+14 CVEs1

60

Microsoft addresses 137 vulnerabilities in May’s Patch Tuesday, including 13 rated critical

CyberScoopMay 12, 21:00 UTC · May 12, 2026Vulnerability in the wildCVE-2026-33109 CVE-2026-42823 CVE-2026-42898+2 CVEs

60