Azure vulnerabilities
We track 8 vulnerabilities in Azure products across 6 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on April 24, 2026.
Latest Azure vulnerabilities
- 7.5 High severity
go-ntlmssp: Integer Overflow or Wraparound
go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport
- 8.1 High severity
azure-c-shared-utility: Buffer Copy without Checking Size of Input
The azure-c-shared-utility is a C library for AMQP/MQTT communication to Azure Cloud Services. This library may be used by the Azure IoT C SDK for communication between IoT Hub and IoT Hub devices. An attacker can cause an integer wraparound or under-allocatio
- 9.8 Critical severity
azure-uamqp-c: Double Free
The uAMQP is a C library for AMQP 1.0 communication to Azure Cloud Services. When processing an incorrect `AMQP_VALUE` failed state, may cause a double free problem. This may cause a RCE. Update submodule with commit 2ca42b6e4e098af2d17e487814a91d05f6ae4987.
- 8.1 High severity
azure-uamqp-c: Use After Free
The UAMQP is a general purpose C library for AMQP 1.0. During a call to open_get_offered_capabilities, a memory allocation may fail causing a use-after-free issue and if a client called it during connection communication it may cause a remote code execution. U
- 9.8 Critical severity
ipam: Improper Authentication
Azure IPAM (IP Address Management) is a lightweight solution developed on top of the Azure platform designed to help Azure customers manage their IP Address space easily and effectively. By design there is no write access to customers' Azure environments as th
- 9.8 Critical severity
azure-uamqp-c: Integer Overflow or Wraparound
Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safe
- 7.0 High severity
setup-kubectl: Incorrect Permission Assignment for Critical Resource
Azure/setup-kubectl is a GitHub Action for installing Kubectl. This vulnerability only impacts versions before version 3. An insecure temporary creation of a file allows other actors on the Actions runner to replace the Kubectl binary created by this action be
- 9.8 Critical severity
azure-cli: Improper Neutralization of Special Elements used in an OS Command
Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have b