Skip to content
OpenAdvisories
Medium NCSC-2025-0081 4 CVEs

Kwetsbaarheden verholpen in Microsoft Azure

Published Mar 11, 2025 · Updated Mar 11, 2025 · nl

Vendor: Microsoft Product: Azure Agent for Backup Product: Azure Agent for Site Recovery Product: Azure ARC Product: Azure CLI Product: Azure promptflow-core Product: Azure promptflow-tools

Summary

Microsoft heeft kwetsbaarheden verholpen in diverse Azure producten.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om zich verhoogde rechten toe te kennen of willekeurige code uit te voeren met de rechten van de kwetsbare applicatie.

```
Azure PromptFlow:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24986 | 6.50 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|

Azure Arc:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-26627 | 7.00 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|

Azure CLI:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-24049 | 8.40 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|

Azure Agent Installer:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2025-21199 | 6.70 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
```

Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:

https://portal.msrc.microsoft.com/en-us/security-guidance

Vulnerabilities 4

  • High 8.4
    CVE-2025-24049

    Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability

    Improper neutralization of special elements used in a command ('command injection') in Azure Command Line Integration (CLI) allows an unauthorized attacker to elevate privileges locally.

    Microsoft Azure CLI
  • High 7.0
    CVE-2025-26627

    Azure Arc Installer Elevation of Privilege Vulnerability

    Improper neutralization of special elements used in a command ('command injection') in Azure Arc allows an authorized attacker to elevate privileges locally.

    Microsoft Azure ARC
  • Medium 6.7
    CVE-2025-21199

    Azure Agent Installer for Backup and Site Recovery Elevation of Privilege Vulnerability

    Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally.

    Microsoft Azure Agent for Site Recovery Azure Agent for Backup
  • Medium 6.5
    CVE-2025-24986

    Azure Promptflow Remote Code Execution Vulnerability

    Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.

    Microsoft Azure promptflow-tools Azure promptflow-core promptflow-tools PyPI

Revision history

  1. #1.0.0

    Initiele versie