Critical Azure Automation Flaw Enabled Cross-Tenant Identity Takeover

Microsoft remediated a critical Azure Automation vulnerability, tracked as CVE-2025-29827 and rated CVSS 9.9, that could have allowed an attacker to take over another tenant’s automation identity. The issue stemmed from a public-by-default Azure Automation configuration combined with additional code flaws, creating an exploit chain that let an attacker with access to their own Azure Automation account impersonate identities across tenants and potentially reach data, credentials, scripts, and other cloud resources.

Reporting on the flaw said the attack path required three weaknesses: publicly exposed Azure Automation account endpoints by default and two separate code-level bugs. Microsoft said it changed the default behavior so Azure Automation identities are no longer public by default, and no known in-the-wild exploitation has been reported. The finding echoes earlier research into Azure Automation security and underscores how cloud identity exposure and chained logic flaws can turn default service settings into high-impact cross-tenant compromise paths.