Loading vulnerability…
Azure Logic Apps Improper Access Control Privilege Escalation
CVE-2026-83944 is an improper access control vulnerability in the Microsoft-hosted Azure Logic Apps service. An unauthenticated attacker can exploit the issue remotely to elevate privileges. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, reflecting low-complexity network exploitation without prior privileges or user interaction and a scope change.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables elevation of privilege in Azure Logic Apps. It can result in high-impact unauthorized access to confidential data and unauthorized modification of protected resources or workflows. The reported CVSS assessment indicates no direct availability impact.
If you can’t patch tonight, do this now.
No separate temporary workaround is specified. Apply least-privilege access controls, review Logic Apps connectors and integrations for excessive permissions, and investigate anomalous role assignments, API activity, workflow changes, and resource modifications.
Patch, then assume compromise.
Azure Logic Apps is an exclusively hosted service; customers cannot independently apply a platform patch. Verify that Microsoft has deployed the relevant security fix to affected tenancies and follow Microsoft Security Response Center guidance for the service.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.