Executive brief
Microsoft Azure API Management (APIM), a platform used by organizations to publish and manage APIs for external and internal developers, contains a security vulnerability. An authorized user with high-level permissions could bypass security controls to execute unauthorized code across the network. This could lead to a complete compromise of the service, potentially impacting the confidentiality and integrity of managed data and disrupting business operations.
Technical details
A vulnerability classified as improper access control (CWE-284) exists within Microsoft Azure API Management (APIM). The flaw allows a remote attacker with high privileges (PR:H) to bypass security restrictions and achieve remote code execution (RCE) over the network. While the attack complexity is rated as high, a successful exploit results in a scope change (S:C), indicating the attacker could impact components beyond the immediate security scope of the APIM instance. As this is an exclusively hosted service, Microsoft typically manages the deployment of fixes directly to the Azure infrastructure.
Affected products
- Microsoft Azure API Management (APIM) All versions
Timeline
- 2026-07-24: advisory: Initial disclosure by Microsoft and NVD.