22 matches found
CVE-2026-35425
Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...
CVE-2026-35425
CVE-2026-35425 concerns Azure API Management (APIM) with an βImproper access controlβ condition that enables a network-exposed remote code execution by an authorized attacker. Affected software is APIM; the root cause is access-control weaknesses that allow code execution over the network. The pr...
EUVD-2026-48455
Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...
CVE-2026-35425 Azure API Management (APIM) Remote Code Execution Vulnerability
...
CVE-2026-35425
Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...
CVE-2026-35425 Azure API Management (APIM) Remote Code Execution Vulnerability
...
PT-2026-64201
Name of the Vulnerable Software and Affected Versions Azure API Management affected versions not specified Description Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network. Recommendations At the moment, there is no information about a...
CVE-2026-35425: Improper Access Control
Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...
Azure API Management (APIM) Remote Code Execution Vulnerability
Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...
KLA91175 Multiple vulnerabilities in Microsoft Azure
Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability i...
EUVD-2025-210492
In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...
CVE-2025-66390
In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...
CVE-2025-66390: Improper Access Control
In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...
CVE-2025-66390
Microsoft Azure API Management (prior to 2025-10-17) contains a vulnerability where the underlying signup API endpoint remains active even if self-service registration is disabled via the portal UI. When Basic Authentication is enabled, an attacker can perform a cross-tenant signup bypass by reus...
CVE-2025-66390
In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...
π Azure APIM 2 Vulnerability Checker
This PHP script is a full vulnerability scanner with proof of concepts for Azure API Management APIM instances, focusing on the possibility of crossβtenant account signup bypass through the Basic Auth Identity Provider...
Azure-APIM-Cross-Tenant-Signup-Bypass
Azure APIM Cross-Tenant Signup Bypass Status 01.12.2025...
Researchers Discover 3 Vulnerabilities in Microsoft Azure API Management Service
Three new security flaws have been disclosed in Microsoft Azure API Management service that could be abused by malicious actors to gain access to sensitive information or backend services. This includes two server-side request forgery SSRF flaws and one instance of unrestricted file upload...
Microsoft Azure Services Flaws Could've Exposed Cloud Resources to Unauthorized Access
Four different Microsoft Azure services have been found vulnerable to server-side request forgery SSRF attacks that could be exploited to gain unauthorized access to cloud resources. The security issues, which were discovered by Orca between October 8, 2022 and December 2, 2022 in Azure API...
U.S. Dept Of Defense: Unauthenticated access to internal API atββββββββββ.βββ.edu [HtUS]
There was unauthenticated access to internal API atββββββββββ.βββ.edu. Multiple API calls allowed an attacker to gain access to the internal API via the Azure API url appg3entcalapi.azurewebsites.net. The access toβββββ.ββββββ.edu was only supposed to be available to internal users...