CVE-2026-35425Disclosure(microsoft / azure_api_management)

MEDIUMCVSS 7.2 · HIGH

Exploitation ongoing with high activity in latest observed window (2 mentions)

Immediate actions

Patch microsoft azure_api_management systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.

microsoft CVEs Back to dashboard

4.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35425

Weakness type (CWE)

CWE-284

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

azure_api_management

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
4 mentions across 2 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 2 signals
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 1d ago at 2 mentions (2026-07-24); latest day: 2
4 total mentions across 2 days

Affected systems

Vendors

microsoft

Products

azure_api_management

1 version affected across 1 product

Deep dive

Activity timeline4 mentions / 2d

Signal classification3 categories

Disclosure

250.0%

Active Exploitation

125.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-24	2	Active Exploitation1Disclosure1
2026-07-27	2	Disclosure1Patch1

Full discourse4 posts

kawn@kawn202088d
Disclosure
#securityupdate #microsoft #定例外 2026. 7.23 Azure API Management (APIM) のリモートでコードが実行される脆弱性 CVE-2026-35425 Security Vulnerability リリース日: - マイクロソフト https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35425
Post summary
Microsoft publicly discloses a remote code execution vulnerability (CVE‑2026‑35425) affecting Azure API Management, directing readers to the Microsoft update guide for further details.
10100102
92 followersView on X
kawn@kawn202088d
Patch
#securityupdate #microsoft #定例外 CVE-2026-35425 「…するために、お客様が取るべきアクションはありません」影響: リモートでコードが実行される最大深刻度: 緊急 CVSS:3.1 8.0 / 7.0 悪用可能性・一般に公開: No ・悪用: No ・Exploitability assessment: 対象外 https://x.com/kawn2020/status/2081623078866731186
Post summary
Microsoft’s advisory for CVE‑2026‑35425 reports a remote code execution vulnerability (CVSS 8.0), but indicates no customer action is needed, implying the vendor has already applied a fix.
1000027
92 followersView on X
VulDB 🛡@vuldb91d
Active Exploitation
A lot of offensive activities were identified targeting Microsoft Azure API Management (CVE-2026-35425) https://vuldb.com/vuln/382841/cti
Post summary
The post reports that Microsoft Azure API Management is being actively exploited via CVE-2026-35425, with no PoC, exploit code, or remediation details provided.
00000105
2.3K followersView on X
Windows Forum@windowsforum92d
Disclosure
⚠️ Microsoft’s Azure API Management RCE advisory is light on details—because apparently “remote code execution” wasn’t alarming enough. Cloud teams should treat the silence as a patching prompt. https://windowsforum.com/threads/cve-2026-35425-azure-api-management-rce-details-remain-limited.440216/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #RemoteCodeExecution #CloudSecurity #AzureApiManagement https://t.co/oQG7KbC3OR
Post summary
The post highlights that Microsoft’s Azure API Management RCE advisory (CVE-2026-35425) offers limited detail and urges cloud teams to treat the silence as a reason to patch, without providing specific technical or mitigation information.
0000071
1.3K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	microsoft	azure_api_management	-	-	-

Explore more

Back to dashboard microsoft CVEs azure_api_management vulnerabilities

What researchers are saying

CVE-2026-35425

Windows Forum[verified]@windowsforumDisclosure

The post highlights that Microsoft’s Azure API Management RCE advisory (CVE-2026-35425) offers limited detail and urges cloud teams to treat the silence as a reason to patch, without providing specific technical or mitigation information.

kawn@kawn2020Disclosure

Microsoft publicly discloses a remote code execution vulnerability (CVE‑2026‑35425) affecting Azure API Management, directing readers to the Microsoft update guide for further details.

kawn@kawn2020Patch

Microsoft’s advisory for CVE‑2026‑35425 reports a remote code execution vulnerability (CVSS 8.0), but indicates no customer action is needed, implying the vendor has already applied a fix.

VulDB 🛡@vuldbActive Exploitation

The post reports that Microsoft Azure API Management is being actively exploited via CVE-2026-35425, with no PoC, exploit code, or remediation details provided.