Azure Sphere Unsigned Code Execution Vulnerability

CVE-2021-28460 is a security vulnerability in Azure Sphere (CVSS 8.1).

1 version

Microsoft id: CVE-2021-28460
Products: Azure Sphere
CVSS: 8.1
CVSS vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
Exploited: No
Publicly disclosed: No
Exploitability: Exploitation Less Likely
Customer action required: Yes
Release: 2021-Apr
Assigned by: Microsoft
MSRC revision: 1.0
Status pages: Azure Sphere status
First captured by us: 13 Nov 2026, 14:47 UTC (from our first import of this list)
Microsoft last modified: 13 Apr 2021, 07:00 UTC
Source: Security updates · open the original at Microsoft

Microsoft's revision notes

What version of Azure Sphere has the update that protects from this vulnerability?

Security updates, 07:00 UTC, 13 Apr 2021

One version so far. If Microsoft edits it, each change shows here with what was removed and added.

First version we captured · 14:47 UTC, 13 Nov
The text as we first saw it
Seen by us 14:47 UTC, 13 Nov · Microsoft's timestamp 07:00 UTC, 13 Apr 2021 · Microsoft's page

Last updated 13 Nov 2026, 14:47 UTC