CVE-2025-29827
Published: 08 May 2025
Summary
CVE-2025-29827 is a critical-severity Improper Authorization (CWE-285) vulnerability in Microsoft Azure Automation. Its CVSS base score is 9.9 (Critical).
Operationally, ranked in the top 18.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-29827 is an improper authorization vulnerability, tracked under CWE-285 and CWE-863, that affects Azure Automation. The flaw carries a CVSS 3.1 score of 9.9 and permits an authenticated user to perform actions beyond their intended privileges when interacting with the service over a network.
An authorized attacker with low-privileged access can exploit the issue remotely without user interaction. Successful exploitation allows the attacker to elevate privileges, resulting in high impact to confidentiality and integrity plus limited impact to availability, with the scope changed across trust boundaries.
The Microsoft Security Response Center has published an advisory for this vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29827. The EPSS score remains low and unchanged at 0.0149 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-14049
Vulnerability details
Improper Authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Documented procedures facilitate correct implementation and ongoing management of authorization decisions.
Periodic reviews identify and correct flaws in authorization decisions or enforcement.
Establishing permitted attributes and values, plus auditing changes, ensures authorization decisions are based on correctly managed policy data.
Explicitly mandates authorizing remote access types before permitting connections, directly mitigating improper authorization.
The control explicitly requires authorization of each wireless access type prior to permitting connections.
Mandating explicit authorization of mobile device connections reduces the risk of improper authorization decisions for system access.
Specifying access authorizations for each account and requiring approvals for account requests enforces proper authorization decisions.
Requires explicit authorization for individuals to use external systems to access or handle organization-controlled information.