CVE-2026-77900

Received Received - Intake

Remote Code Execution in Azure App Service

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: Microsoft Corporation

Description

Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-08

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-10-09

EPSS Evaluated

N/A

NVD

CVE-2026-77900

EUVD

EUVD-2026-95394

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	Azure	App Service for Linux *

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability involves missing authentication for a critical function in Azure App Service. An unauthorized attacker can exploit this to execute code remotely over a network without needing valid credentials.

Impact Analysis

An attacker could gain full control over affected systems, leading to data breaches, unauthorized access to sensitive information, or disruption of services. The high CVSS score indicates severe potential impact.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, or other regulations due to unauthorized data access or exposure. Organizations may face legal penalties or reputational damage.

Mitigation Strategies

Enable authentication for critical functions in Azure App Service and ensure network access controls are in place to restrict unauthorized access.

Hi! I’m here to help you understand CVE-2026-77900. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70