Improper Access Control in Azure Virtual Machines by Microsoft
CVE-2025-49707

7.9HIGH

Key Information:

Vendor

Microsoft
Status
Dcasv5-series Azure Vm
Dcadsv5-series Azure Vm
Ecasv5-series Azure Vm
Ecadsv5-series Azure Vm
Vendor
CVE Published:
12 August 2025

What is CVE-2025-49707?

An improper access control vulnerability in Azure Virtual Machines permits an authorized attacker to execute spoofing attacks locally. This security flaw can potentially allow unauthorized actions within the system, highlighting the importance of comprehensive access management. Organizations utilizing Azure Virtual Machines must evaluate their security configurations and implement necessary mitigations to prevent the exploitation of this vulnerability.

Affected Version(s)

DCadsv5-series Azure VM Unknown

DCasv5-series Azure VM Unknown

DCedsv5-series Azure VM Unknown

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisory

CVSS V3.1

Score:
7.9
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-49707 : Improper Access Control in Azure Virtual Machines by Microsoft