CVE-2022-35809

Deeper analysis

CVE-2022-35809 is an elevation of privilege vulnerability affecting Azure Site Recovery. The flaw carries a CVSS 3.1 base score of 6.5 and is reachable over the network with low attack complexity, requiring an authenticated high-privileged account but no user interaction. Successful exploitation can allow an attacker to modify or disrupt the integrity and availability of recovery resources while leaving confidentiality untouched.

An attacker already holding administrative privileges within the Azure Site Recovery environment can leverage the weakness to escalate rights and perform unauthorized changes that affect service operations or data integrity. Because the vulnerability is network-exposed, the malicious actions can originate from remote locations without additional user assistance.

Microsoft has published remediation guidance for CVE-2022-35809 in its Security Response Center update guide, directing administrators to apply the fixes referenced in the advisory. The associated EPSS score has remained flat at 0.0631 with no material increase since disclosure.