Cyber Resilience

CVE-2026-40412

Critical

Published: 22 May 2026

Published
22 May 2026
Modified
27 May 2026
KEV Added
Patch
CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0053 41.1th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-40412 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Microsoft Azure Orbital Spatio. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code over a network.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1505.003 Web Shell Persistence
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Why these techniques?

Unrestricted file upload (CWE-434) on a public-facing Azure service directly enables remote code execution, mapping to exploitation of public apps and web shell deployment.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-21536Same vendor: Microsoft
CVE-2021-31207Same vendor: Microsoft
CVE-2026-23659Same vendor: Microsoft
CVE-2019-25630Shared CWE-434
CVE-2025-12846Shared CWE-434
CVE-2026-1357Shared CWE-434
CVE-2015-10144Shared CWE-434
CVE-2025-7065Shared CWE-434
CVE-2026-0911Shared CWE-434
CVE-2025-14532Shared CWE-434

Affected Assets

microsoft
azure orbital spatio
all versions

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-434

Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.

addresses: CWE-434

Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.

addresses: CWE-434

Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.

addresses: CWE-434

Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.

References