Azure Event Grid System Elevation of Privilege Vulnerability
CVE-2025-59273 is an elevation of privilege vulnerability in Azure Event Grid (rated Critical, CVSS 7.3). Microsoft fixed it in the service; customers need to do nothing.
1 version
Facts
- Microsoft id
CVE-2025-59273- Products
- Azure Event Grid
- Severity
- Critical
- Impact
- Elevation of Privilege
- CVSS
- 7.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Customer action required
- No
- Release
- 2025-Oct
- Assigned by
- Microsoft
- Weakness
- CWE-284: Improper Access Control
- MSRC revision
- 1.0
- Status pages
- Azure Event Grid status
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2025-10-23:
Information published.
Microsoft says
Improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page
Related changes
Other changes for Azure Event Grid
- Public preview: SAP S/4HANA events are now available on Azure Event Grid · In preview
- New Azure Event Grid capabilities support IoT solutions, event sources · Launched
- MQTT broker feature, PubSub capabilities now available for Azure Event Grid · Launched
- Public preview: Microsoft Graph API integration with Azure Event Grid · In preview
- Public preview: Event Grid enables user authorization to create partner topics · In preview
- Update: Event Grid on Azure IoT Edge preview will retire on 31 March 2023
- Generally available: Event Grid upgrade enhancements for AKS · Launched
- Public preview: API Management and Event Grid integration · In preview
Last updated