VulnSocial

CVE-2025-29827Active Exploitation(microsoft / azure_automation)

MEDIUMCVSS 8.8 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch microsoft azure_automation systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.

microsoft CVEsBack to dashboard
4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-285CWE-863

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • azure_automation

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-07-24); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
microsoft
Products
azure_automation

1 version affected across 1 product

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-07-24: 1Mentions · 2026-07-27: 1Active Exploitation · 2026-07-24: 1Patch / Workaround · 2026-07-27: 1Technical Details · 2026-07-24: 1Technical Details · 2026-07-27: 107-2407-27
Signal classification2 categories
Active Exploitation
150.0%
Patch
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-241
Active Exploitation1
2026-07-271
Patch1
Full discourse2 posts
  • Windows Forum@windowsforum
    Patch

    🚨 Microsoft fixed a 9.9-rated Azure Automation flaw that could cross Entra tenant boundaries. Cloud isolation is great—until “separate customers” becomes more of a suggestion. https://windowsforum.com/windows-news.4/cve-2025-29827-microsoft-fixes-azure-automation-cross-tenant-flaw.440603/?utm_source=x&utm_medium=social&utm_campaign=news_node4 #MicrosoftEntra #CloudSecurity #PrivilegeEscalation #AzureAutomation https://t.co/HJpiLFhLAE

    Post summary

    Microsoft has released a patch for CVE‑2025‑29827, a high‑severity Azure Automation flaw that could enable cross‑tenant data exposure.

    0000038
    1.3K followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows attackers exploited CVE-2025-29827 to assume Azure Automation identities across tenants, enabling privilege escalation and lateral movement within cloud environments. This cross-tenant identity takeover highlights critical gaps in cloud identity isolation. #CloudSecurity #IdentitySecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/default-azure-automation-setting-enables-cross-tenant-identity-takeover-cve-2025-29827

    Post summary

    The text reports confirmed real‑world exploitation of CVE‑2025‑29827, where attackers leveraged the vulnerability to commandeer Azure Automation identities across tenants, achieving privilege escalation and lateral movement within cloud environments.

    0000054
    1.9K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appmicrosoftazure_automation---

Explore more

Back to dashboardmicrosoft CVEsazure_automation vulnerabilities