CVE-2025-59273
Published: 23 October 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-59273 is an improper access control vulnerability (CWE-284) in Azure Event Grid. Published on 2025-10-23, it carries a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). The flaw stems from inadequate access controls, enabling unauthorized privilege elevation over a network.
An unauthorized attacker with network access can exploit this vulnerability with low complexity, requiring no privileges, user interaction, or special conditions. Exploitation allows the attacker to elevate privileges, leading to low-level impacts on confidentiality, integrity, and availability.
Microsoft's Security Response Center provides mitigation details in its update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59273.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Vulnerability enables unauthorized network-based privilege escalation via improper access control in public-facing Azure service, directly mapping to T1190 (Exploit Public-Facing Application) and T1068 (Exploitation for Privilege Escalation).