CVE-2026-77900: Azure App Service Remote Code Execution Vulnerability
Published Oct 8, 2026
·Updated
Azure App Service Remote Code Execution Vulnerability
Other sources
Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
— Microsoft
Affected Software
2 affected components
Microsoft Azure App Service
Microsoft Azure App Service for Linux
Event History
Oct 8, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·10:15 PM
Data Sourced
via MITRE·10:15 PM
DescriptionSeverity
Data Sourced
via NVD·11:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this vulnerability?
An unauthorized attacker can exploit it remotely over a network. No authentication or user interaction is required.
2
What is the likely impact if exploitation succeeds?
Successful exploitation allows execution of code in the affected Azure App Service environment. The supplied severity metrics indicate high impact to confidentiality, integrity, and availability.
3
Which products are identified as affected?
The affected software listed is Microsoft Azure App Service and Microsoft Azure App Service for Linux.