Loading vulnerability…
Azure Logic Apps Path Traversal Privilege Escalation
CVE-2026-70200 is a path-traversal vulnerability in the exclusively hosted Azure Logic Apps service. Improper limitation of pathnames to an authorized directory boundary permits an unauthenticated network attacker to elevate privileges. The vulnerability has a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N and is also associated with improper authorization.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables privilege escalation across a changed security scope. An attacker can obtain high-impact unauthorized access to confidential information and modify protected resources or data. No direct availability impact is indicated by the CVSS vector.
If you can’t patch tonight, do this now.
No vulnerability-specific temporary workaround is specified. Restrict Azure Logic Apps permissions and connector privileges to the minimum necessary, review integrations that access sensitive resources, and investigate anomalous role assignments, API activity, and resource changes.
Patch, then assume compromise.
Azure Logic Apps is a Microsoft-managed hosted service; customers should verify that Microsoft has deployed the security fix to their tenant and follow the applicable Microsoft Security Response Center advisory guidance. Customers cannot independently patch the underlying service platform.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.