Loading story…
Research has shown that Azure Storage account read and write permissions can be abused to gain broader access in cloud environments, turning what appears to be limited storage access into a path for privilege escalation and lateral movement. The findings are significant because Azure Storage accounts are widely used across organizations for blobs, files, queues, and tables, and Microsoft recommends general-purpose v2 accounts as the standard deployment model for most workloads.
Microsoft documentation underscores how central these accounts are to Azure operations, noting built-in encryption at rest, multiple redundancy options, fixed account-type choices after creation, and endpoint behaviors that administrators must manage carefully. Together, the research and platform guidance indicate that mis-scoped permissions on storage accounts can create outsized security risk, making least-privilege access, careful role assignment, and review of legacy or migrated storage configurations critical for defenders.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft states that classic Azure storage accounts were retired and advises customers to migrate legacy or GPv1 accounts to Azure Resource Manager and GPv2 where applicable.
A Security Friends' Research Blog post titled "Not the Access You Asked For: How Azure Storage Account Read/Write Permissions Can Be Abused for Privilege Escalation and Lateral Movement" was published, disclosing abuse of Azure Storage account read/write permissions for privilege escalation and lateral movement.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
learn.microsoft.com
Open sourceblog.fndsec.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Germany's dCERT published two advisories covering **multiple vulnerabilities in Microsoft Azure**, with the later notice stating that the flaws can allow **privilege escalation**. The advisories identify Azure as the affected platform but provide no public synopsis, indicating only that several security issues were addressed across the cloud service. The paired notices suggest an evolving disclosure in which Microsoft Azure vulnerabilities were first reported broadly and then updated with a more specific impact assessment tied to elevated privileges. Organizations using Azure should review the corresponding vendor guidance and remediation information for the affected services, prioritize patching, and assess whether exposed identities, roles, or cloud resources could be affected by unauthorized privilege gains.
Jun 29, 2026
NetSPI reported that Azure's built-in **Anyscale Platform Administrator** role granted unconstrained `Microsoft.Authorization/roleAssignments/write` and `Microsoft.Authorization/roleAssignments/delete` permissions. A principal assigned that role could create role assignments for itself or others, including the highly privileged **Owner** role, creating a subscription-level privilege-escalation path that conventional role-centric reviews could overlook. Microsoft Security Response Center confirmed the finding reported on June 8, 2026, and removed the dangerous role-assignment permissions from the built-in role by June 22. The researchers also warned that a Microsoft-recommended ABAC condition intended to constrain Owner or User Access Administrator assignment can be bypassed by identities able to modify role definitions and create an unconstrained custom role; Azure administrators should review effective RBAC and ABAC permissions, restrict assignment scope, segment subscriptions, and enforce least privilege for built-in as well as custom roles.
Sep 3, 2026
Microsoft has published security advisories for multiple **elevation of privilege** vulnerabilities affecting cloud and identity-related products, including **Payment Orchestrator Service** (`CVE-2026-26125`), **Microsoft Account** (`CVE-2025-21396`), **Azure Bot Service** (`CVE-2025-55244`), **Azure PolicyWatch** (`CVE-2024-49052`), and **Azure CycleCloud** (`CVE-2022-41085`). The issues were disclosed through the Microsoft Security Response Center and span both Azure platform components and Microsoft-managed account services. The advisories provide limited public technical detail, but the affected products indicate potential risk to organizations relying on Microsoft cloud workloads, automation, policy management, bot integrations, and identity services. Security teams should review the relevant MSRC entries, determine whether exposed services are in use, and prioritize remediation for any impacted environments where privilege escalation could increase access to sensitive resources or administrative functions.
Jul 12, 2026