CVE-2026-32171
Published: 14 April 2026
Summary
CVE-2026-32171 is a high-severity Insufficiently Protected Credentials (CWE-522) vulnerability in Microsoft Azure Logic Apps. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 35.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-32171 involves insufficiently protected credentials in Azure Logic Apps, as detailed in its description published on 2026-04-14T18:17:19.843. This vulnerability, mapped to CWE-522, carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility, low attack complexity, and significant impacts across confidentiality, integrity, and availability.
An authorized attacker with low privileges (PR:L) can exploit this vulnerability over the network (AV:N) without requiring user interaction (UI:N). Successful exploitation enables privilege escalation, achieving high-level compromise of confidentiality, integrity, and availability (C:H/I:H/A:H).
Mitigation guidance is available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32171.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22560
Vulnerability details
Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct mapping from CWE-522 insufficient credential protection in Azure Logic Apps, enabling low-priv network attacker to retrieve credentials (T1552) and escalate privileges (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires secure management and protection of authenticators including credentials in Azure Logic Apps to prevent unauthorized access by low-privileged attackers.
Enforces least privilege to mitigate privilege escalation by ensuring low-privileged accounts cannot access or exploit elevated credentials.
Mandates enforcement of approved access authorizations to block low-privileged network attackers from reaching insufficiently protected credentials.