CVE-2025-47995: Azure Machine Learning Privilege Escalation

CVE-2025-47995 Overview

CVE-2025-47995 is a weak authentication vulnerability in Microsoft Azure Machine Learning that allows an authorized attacker to elevate privileges over a network. The flaw is tracked under CWE-1390 (Weak Authentication) and affects the Azure Machine Learning service. An attacker holding low-privilege access can leverage the weakness to gain higher privileges within the service, impacting confidentiality, integrity, and availability of Azure Machine Learning workloads. Microsoft published the advisory through the Microsoft Security Response Center and addressed the issue on the service side.

Critical Impact
An authenticated attacker with low privileges can elevate to higher privileges within Azure Machine Learning over the network, exposing models, training data, and compute resources.

Affected Products

Microsoft Azure Machine Learning (cloud service)
Workspaces and compute resources managed under Azure Machine Learning
Identities and tokens scoped to Azure Machine Learning resources

Discovery Timeline

2025-07-18 - CVE-2025-47995 published to the National Vulnerability Database
2025-08-14 - Last updated in NVD database

Technical Details for CVE-2025-47995

Vulnerability Analysis

The vulnerability is a privilege escalation issue rooted in weak authentication within Azure Machine Learning [CWE-1390]. An authorized attacker, meaning a principal that already holds valid but low-privileged credentials in the target environment, can exploit the weakness over the network without user interaction. Successful exploitation yields high impact on confidentiality, integrity, and availability. In an Azure Machine Learning context, that means potential access to training datasets, model artifacts, registered endpoints, and underlying compute clusters that the attacker should not control. The attack complexity is low, which means no specialized conditions or timing are required for exploitation once the attacker obtains a foothold. According to EPSS data, the probability of exploitation activity is elevated relative to the broader CVE population.

Root Cause

The root cause is an authentication weakness within Azure Machine Learning that does not sufficiently bind operations to the privilege level of the calling identity. Microsoft has not publicly disclosed the specific component, but the [CWE-1390] classification indicates that the authentication mechanism either trusts attacker-controllable input, relies on a credential factor that is insufficient for the operation, or fails to enforce the expected authorization boundary after the identity is validated. The result is that an account with limited rights can perform actions reserved for higher-privileged roles within the service.

Attack Vector

The attack vector is network-based. The attacker authenticates to Azure Machine Learning using a low-privileged identity, then issues requests against the service to perform operations beyond the role assigned to that identity. Because no user interaction is required, the attack can be fully automated against any workspace where the attacker holds at least a low-privileged role. No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is published for this vulnerability. Refer to the Microsoft Security Update Guide for CVE-2025-47995 for vendor technical details.

Detection Methods for CVE-2025-47995

Indicators of Compromise

Azure Machine Learning operations executed by principals whose assigned role-based access control (RBAC) roles do not normally permit those actions.
Unexpected creation, modification, or deletion of compute instances, compute clusters, or pipeline jobs within an Azure Machine Learning workspace.
Token or service principal use from atypical source IP addresses, geographies, or user agents against *.api.azureml.ms endpoints.
New role assignments, key rotations, or workspace configuration changes that lack a corresponding change-management record.

Detection Strategies

Correlate Azure Activity Log entries for Microsoft.MachineLearningServices/* operations with the caller identity and assigned RBAC role to flag privilege mismatches.
Baseline normal Azure Machine Learning API call patterns per identity and alert on deviations such as sudden bursts of administrative operations from a data scientist account.
Hunt for chained behaviors such as low-privilege sign-in followed by workspace-level configuration changes within a short window.

Monitoring Recommendations

Enable diagnostic settings on every Azure Machine Learning workspace and stream AmlComputeJobEvent, AmlRunStatusChangedEvent, and audit logs to a centralized SIEM.
Forward Microsoft Entra ID sign-in and audit logs alongside Azure Machine Learning logs to allow joint identity-and-service analysis.
Review service principal and managed identity usage on a recurring schedule to confirm least-privilege scoping.

How to Mitigate CVE-2025-47995

Immediate Actions Required

Confirm that Azure Machine Learning workspaces are running on the Microsoft-patched service plane; this is a cloud service vulnerability remediated by Microsoft.
Review all RBAC role assignments on Azure Machine Learning workspaces and remove any standing high-privilege roles that are not strictly required.
Rotate service principal secrets, managed identity credentials, and personal access tokens used against Azure Machine Learning if any anomalous activity is observed.
Audit recent workspace activity since the publication date of 2025-07-18 for operations that exceed each caller's intended privilege.

Patch Information

Microsoft remediated CVE-2025-47995 at the Azure Machine Learning service layer. Customers do not need to install a client-side update, but should validate that workspace configurations follow current Microsoft guidance. See the Microsoft Security Update Guide for CVE-2025-47995 for authoritative remediation details.

Workarounds

Enforce Conditional Access policies on identities that can reach Azure Machine Learning, including multifactor authentication and trusted-location requirements.
Restrict workspace network access by enabling Azure Machine Learning private endpoints and disabling public network access where possible.
Apply least-privilege RBAC by assigning narrowly scoped built-in roles such as AzureML Data Scientist instead of Contributor or Owner on workspaces.
Continuously review managed identity and service principal permissions to ensure no automation account holds privileges beyond its function.

bash

# Configuration example: restrict Azure Machine Learning workspace to private network access
az ml workspace update \
  --name <workspace-name> \
  --resource-group <resource-group> \
  --public-network-access Disabled

# Assign least-privilege role instead of broad Contributor
az role assignment create \
  --assignee <principal-object-id> \
  --role "AzureML Data Scientist" \
  --scope /subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.MachineLearningServices/workspaces/<workspace-name>