CVE-2025-33074: Microsoft Azure Functions RCE Vulnerability

CVE-2025-33074 Overview

CVE-2025-33074 is an improper verification of cryptographic signature vulnerability in Microsoft Azure Functions. The flaw allows an authorized attacker to execute code over a network against a vulnerable Azure Functions environment. The vulnerability is classified under [CWE-347] (Improper Verification of Cryptographic Signature) and carries a CVSS 3.1 base score of 8.8. Microsoft published a security advisory tracking this issue and released remediation guidance through the Microsoft Security Response Center.

Critical Impact
An authenticated attacker with low-privilege network access can execute arbitrary code in the Azure Functions runtime, compromising confidentiality, integrity, and availability of the affected serverless workload.

Affected Products

Microsoft Azure Functions (cloud service)
Workloads consuming Azure Functions runtime components prior to the Microsoft fix
Applications relying on signed artifacts validated by the affected Azure Functions logic

Discovery Timeline

2025-04-30 - CVE-2025-33074 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-33074

Vulnerability Analysis

The vulnerability stems from improper verification of a cryptographic signature within Microsoft Azure Functions. When the platform processes artifacts that should be authenticated through signature checks, the validation logic fails to enforce the signature correctly. An authorized attacker can supply a crafted payload that bypasses signature trust expectations and causes the runtime to execute attacker-controlled code. Because the attack occurs over the network and does not require user interaction, exploitation can be automated against reachable Azure Functions endpoints. Successful exploitation yields high impact across confidentiality, integrity, and availability of the function workload and adjacent resources sharing the execution context.

Root Cause

The root cause is a flaw in the signature verification routine, mapped to [CWE-347]. The component accepts content whose cryptographic signature is missing, malformed, or not validated against a trusted key, allowing untrusted code paths to be reached.

Attack Vector

The attack vector is Network with Low attack complexity. The attacker must hold Low-level privileges in the targeted Azure Functions tenant or have valid authenticated access. No user interaction is required. The scope is unchanged, but impact on confidentiality, integrity, and availability is High. Public proof-of-concept code is not available, and the Exploit Prediction Scoring System (EPSS) probability sits at 0.459% as of 2026-06-23.

No verified public exploitation code is available. See the Microsoft Security Update CVE-2025-33074 advisory for vendor-provided technical guidance.

Detection Methods for CVE-2025-33074

Indicators of Compromise

Unexpected child processes, outbound network connections, or shell invocations originating from Azure Functions worker processes.
Function execution logs showing deployment or load of packages with missing, malformed, or untrusted signatures.
Authenticated API calls to Azure Functions management endpoints from unusual principals, IP ranges, or service principals.

Detection Strategies

Enable Azure Monitor and Microsoft Defender for Cloud alerts for Azure Functions runtime anomalies and code execution events.
Correlate Azure Activity Log and Entra ID sign-in logs to detect low-privilege identities triggering function deployments or configuration changes.
Inspect function invocation telemetry for unexpected modules, suspicious environment variable use, or commands such as curl, wget, bash, or powershell in serverless runtimes.

Monitoring Recommendations

Forward Azure Functions diagnostic logs, host logs, and platform logs to a centralized SIEM with continuous detection rules.
Monitor identities with Contributor or function deployment rights and alert on unusual access patterns or new credential grants.
Track integrity of deployed function packages and verify signatures against a known-good baseline before promoting code to production slots.

How to Mitigate CVE-2025-33074

Immediate Actions Required

Review the Microsoft Security Update CVE-2025-33074 advisory and apply all updates Microsoft has rolled out to the Azure Functions platform.
Audit Azure role assignments and remove unnecessary contributor or function deployment privileges from users and service principals.
Rotate credentials, function keys, and managed identity secrets associated with potentially exposed function apps.

Patch Information

Microsoft has addressed CVE-2025-33074 through updates to the Azure Functions cloud service. Because Azure Functions is a managed service, the platform-side fix is delivered by Microsoft. Customers should verify their runtime version, redeploy host extensions, and confirm that function apps are running on a patched stamp as described in the Microsoft Security Response Center advisory.

Workarounds

Restrict network exposure of function apps using private endpoints, access restrictions, and IP allowlists to limit authenticated reachability.
Enforce least-privilege RBAC and Conditional Access on identities able to invoke or deploy Azure Functions.
Require signed deployments and validate artifacts in CI/CD pipelines before publishing to production function apps.

bash

# Configuration example: restrict Azure Functions access and enforce managed identity
az functionapp config access-restriction add \
  --resource-group <rg-name> \
  --name <function-app-name> \
  --rule-name AllowCorpOnly \
  --action Allow \
  --ip-address <corporate-cidr> \
  --priority 100

az functionapp identity assign \
  --resource-group <rg-name> \
  --name <function-app-name>

az functionapp update \
  --resource-group <rg-name> \
  --name <function-app-name> \
  --set siteConfig.ftpsState=Disabled siteConfig.http20Enabled=true