Cyber Resilience

CVE-2026-21227

High

Published: 22 January 2026

Published
22 January 2026
Modified
03 February 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS Score 0.0049 38.4th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-21227 is a high-severity Path Traversal (CWE-22) vulnerability in Microsoft Azure Logic Apps. Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-21227, published on 2026-01-22, is an improper limitation of a pathname to a restricted directory vulnerability, classified as path traversal (CWE-22), affecting Azure Logic Apps. This flaw enables unauthorized privilege elevation and carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), indicating high severity due to network accessibility, low attack complexity, and no prerequisite privileges or user interaction.

An unauthorized attacker can exploit this vulnerability remotely over the network without authentication. Successful exploitation allows privilege elevation, resulting in high confidentiality impact through unauthorized access to sensitive data and low integrity impact, with no availability disruption.

The Microsoft Security Response Center advisory provides details on mitigation and patches at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21227.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

CWE(s)
CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Path traversal vulnerability in public-facing Azure Logic Apps enables remote exploitation without authentication (T1190) leading to unauthorized privilege elevation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-42823Same product: Microsoft Azure Logic Apps
CVE-2026-32171Same product: Microsoft Azure Logic Apps
CVE-2025-26683Same vendor: Microsoft
CVE-2025-21177Same vendor: Microsoft
CVE-2025-59245Same vendor: Microsoft
CVE-2026-26125Same vendor: Microsoft
CVE-2025-59503Same vendor: Microsoft
CVE-2025-59246Same vendor: Microsoft
CVE-2026-24304Same vendor: Microsoft
CVE-2025-53763Same vendor: Microsoft

Affected Assets

microsoft
azure logic apps
all versions

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly and comprehensively mitigates path traversal by requiring validation of pathname inputs to ensure they remain within restricted directories.

AC-3 Access Enforcement good match
prevent

Enforces approved access authorizations to block unauthorized privilege elevation resulting from improper pathname limitations.

AC-25 Reference Monitor partial match
prevent

Implements a reference monitor to mediate and enforce access control policies on system resources, countering path traversal bypasses.

References