CVE-2022-35816

Deeper analysis

Azure Site Recovery contains an elevation of privilege vulnerability tracked as CVE-2022-35816. The flaw received a CVSS 3.1 base score of 6.5 with the vector string AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, indicating a remotely exploitable issue that requires high privileges but otherwise low attack complexity and no user interaction.

An authenticated attacker already holding high privileges can leverage the vulnerability over the network to achieve high impact on integrity and availability, consistent with the elevation-of-privilege classification. The EPSS score has remained flat at a peak of 0.0631 with no material increase since disclosure.

Microsoft published advisory details at the Microsoft Security Response Center URL listed in the references; practitioners should consult that guidance for any available patches or configuration changes. No information on observed in-the-wild exploitation is supplied in the source data.