Description
Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network.
Published: 2025-10-23
Score: 10 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 31 Dec 2025 02:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:microsoft:azure_compute_resource_provider:-:*:*:*:*:*:*:*

Thu, 20 Nov 2025 00:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:microsoft:azure_compute_resource_provider:*:*:*:*:*:*:*:*

Fri, 31 Oct 2025 17:00:00 +0000

Type Values Removed Values Added
Description Server-side request forgery (ssrf) in Azure Compute Gallery allows an authorized attacker to elevate privileges over a network. Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network.
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C'}

 cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Fri, 24 Oct 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 24 Oct 2025 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft
Microsoft azure
Microsoft azure Compute Resource Provider
Vendors & Products Microsoft
Microsoft azure
Microsoft azure Compute Resource Provider

Thu, 23 Oct 2025 21:30:00 +0000

Type Values Removed Values Added
Description Server-side request forgery (ssrf) in Azure Compute Gallery allows an authorized attacker to elevate privileges over a network.
Title Azure Compute Resource Provider Elevation of Privilege Vulnerability
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 9.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Azure Azure Compute Resource Provider
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-02-26T16:57:08.485Z

Reserved: 2025-09-17T03:06:33.548Z

Link: CVE-2025-59503

cve-icon Vulnrichment

Updated: 2025-10-24T14:35:06.239Z

cve-icon NVD

Status : Analyzed

Published: 2025-10-23T22:15:48.547

Modified: 2025-12-31T02:30:53.270

Link: CVE-2025-59503

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-10-24T10:16:48Z

Weaknesses