Azure Logic Apps Elevation of Privilege Vulnerability
CVE-2026-70200 is an elevation of privilege vulnerability in Azure Logic Apps (rated Critical, CVSS 10.0). Microsoft fixed it in the service; customers need to do nothing.
1 version
Facts
- Microsoft id
CVE-2026-70200- Products
- Azure Logic Apps
- Severity
- Critical
- Impact
- Elevation of Privilege
- CVSS
- 10.0
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Customer action required
- No
- Release
- 2026-Sep
- Assigned by
- Microsoft
- Weakness
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-285: Improper Authorization
- MSRC revision
- 1.0
- Status pages
- Azure Logic Apps status
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2026-09-17:
Information published.
Microsoft says
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page
Related changes
Other changes for Azure Logic Apps
- Public Preview of Azure OpenAI and AI Search in-app connectors for Logic Apps (Standard) · In preview
- Public Preview Azure Integration Account Enhancements · In preview
- Public Preview Azure Logic Apps Monitoring Dashboard for Workflow Monitoring, Troubleshooting, and Resubmissions · In preview
- Public Preview Azure Logic Apps Standard Deployment Scripting Tools in VS Code · In preview
- Public Preview Azure Logic Apps Standard] .NET 8 Custom Code Support · In preview
- Public Preview Azure Logic Apps Standard Support for Zero Downtime deployment scenarios · In preview
- Public Preview: Data mapping designer in Azure Logic Apps (Standard) · In preview
- Public Preview – Out of box monitoring dashboards for Logic Apps Standard · In preview
Last updated