CVE-2025-47158
Published: 18 July 2025
Summary
CVE-2025-47158 is a critical-severity Authentication Bypass by Assumed-Immutable Data (CWE-302) vulnerability in Microsoft Azure Devops. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 32.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-2 (Identification and Authentication (Organizational Users)).
Deeper analysis
CVE-2025-47158 is an authentication bypass vulnerability stemming from the use of assumed-immutable data in Azure DevOps. This flaw affects the Azure DevOps service, enabling an unauthorized attacker to bypass authentication mechanisms. The vulnerability is rated with a CVSS v3.1 base score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) and is associated with CWE-302 (Authentication Bypass by Assumed-Immutable Data). It was published on 2025-07-18.
An unauthorized attacker with network access can exploit this vulnerability due to its low privilege requirements (PR:N) and lack of need for user interaction (UI:N), though it involves high attack complexity (AC:H). Successful exploitation allows privilege elevation, leading to high confidentiality, integrity, and availability impacts (C:H/I:H/A:H) with a scope change (S:C), potentially granting full control over affected Azure DevOps instances.
Microsoft's Security Response Center (MSRC) provides guidance on mitigation and patching in its update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47158. Security practitioners should consult this advisory for specific remediation steps.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21915
Vulnerability details
Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authentication bypass in public-facing Azure DevOps service directly enables remote exploitation for initial access and privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires identification and authentication of organizational users before network access, directly preventing authentication bypass via assumed-immutable data.
Enforces logical access authorizations in accordance with policy, blocking unauthorized privilege elevation from authentication bypass flaws.
Limits privileges to only those necessary for tasks, reducing the impact of privilege escalation following authentication bypass.