CVE-2026-70200: Azure Logic Apps Elevation of Privilege Vulnerability
Published Sep 17, 2026
·Updated
Azure Logic Apps Elevation of Privilege Vulnerability
Other sources
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
— Microsoft
Affected Software
1 affected component
Microsoft Azure Logic Apps
Event History
Sep 17, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·02:00 PM
Affected Software
Updated
via Microsoft·02:00 PM
Description
CVE Published
via MITRE·10:55 PM
Data Sourced
via MITRE·10:55 PM
DescriptionSeverity
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The issue is network-reachable and requires no privileges or user interaction. The attack complexity is rated low.
2
What is the likely impact if exploitation succeeds?
Successful exploitation can elevate an unauthorized attacker's privileges. The supplied vector rates confidentiality and integrity impact as high, while availability impact is rated none.
3
Is there a workaround if patching cannot be performed immediately?
No workaround, mitigation, or affected configuration details are provided in the available data.