CVE-2026-62874

CVE-2026-62874 is a critical flaw (CWE-345, Insufficient Verification of Data Authenticity) in Microsoft's Azure Billing service, which fails to properly validate the authenticity of data it accepts. An unauthenticated remote attacker can trigger the flaw over a network with no privileges required and no user interaction, by supplying forged or spoofed data that the service trusts. Successful exploitation elevates the attacker's privileges with a scope change beyond the vulnerable component, yielding high confidentiality and integrity impact and low availability impact — potentially allowing access to or manipulation of billing/subscription data. Effectively every organization with an Azure subscription that uses Azure Billing is in scope, since it is a core Azure service patched server-side by Microsoft. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known at this time.

What to do: Because Azure Billing is a Microsoft-managed cloud service, remediation is delivered service-side — verify your tenant has received the update per Microsoft's advisory and confirm no tenant action is required. In the meantime, review Azure Activity Logs, billing/role assignment changes, and billing administrator role memberships for signs of abuse, and follow least-privilege on Billing and Subscription admin roles. Monitor Microsoft's advisory for updated indicators or guidance.