CVE-2025-49747: Azure Machine Learning Privilege Escalation

CVE-2025-49747 Overview

CVE-2025-49747 is a missing authorization vulnerability in Microsoft Azure Machine Learning. The flaw allows an authenticated attacker to elevate privileges over a network. Microsoft assigned this issue a CVSS 3.1 score of 8.8 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness is classified as [CWE-862] Missing Authorization.

A successful exploit grants the attacker high impact to confidentiality, integrity, and availability of the targeted Azure Machine Learning workspace. Microsoft has addressed the issue at the service level, and no customer action is required for the underlying platform fix according to the Microsoft CVE-2025-49747 Advisory.

Critical Impact
An authenticated network attacker can bypass authorization checks in Azure Machine Learning and escalate privileges, gaining high-impact access to workspace resources, training data, models, and compute.

Affected Products

Microsoft Azure Machine Learning (cloud service)
Workspaces and compute resources managed through Azure Machine Learning
Pipelines, models, and datasets accessible through the affected service plane

Discovery Timeline

2025-07-18 - CVE-2025-49747 published to NVD
2025-08-14 - Last updated in NVD database

Technical Details for CVE-2025-49747

Vulnerability Analysis

The vulnerability resides in the authorization layer of Azure Machine Learning. The service fails to enforce proper access checks on one or more privileged operations exposed to authenticated users. An attacker with low-privileged credentials in a workspace can invoke functionality reserved for higher-privileged roles.

The attack vector is network-based and requires no user interaction. Attack complexity is low, meaning the attacker does not need to win race conditions or satisfy unusual preconditions. Once exploited, the attacker gains control over resources within the targeted scope, including the ability to read, modify, or disrupt workloads.

The vulnerability falls under [CWE-862] Missing Authorization. This class of flaw occurs when an application performs an action without verifying that the requesting principal holds the required permissions. In a multi-tenant machine learning platform, the consequences include exposure of proprietary models, tampering with training pipelines, and abuse of compute quotas.

Root Cause

The root cause is an incomplete authorization check on an Azure Machine Learning service endpoint. The service trusted authenticated callers without validating that the caller held the role required to perform the requested operation. EPSS data places the exploit probability at 1.068% in the 78th percentile, indicating elevated relative likelihood compared to most CVEs.

Attack Vector

The attacker authenticates to Azure with any valid identity that has baseline access to the targeted Azure Machine Learning workspace. The attacker then issues requests to the affected API or management endpoint. Because the service does not validate the caller's role for the privileged operation, the request executes with elevated effect. Microsoft has not published exploit details, and no public proof-of-concept exists. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

Microsoft has not released sanitized exploitation code. See the Microsoft CVE-2025-49747 Advisory for the official technical description and remediation guidance.

Detection Methods for CVE-2025-49747

Indicators of Compromise

Azure Activity Log entries showing role-sensitive operations performed by identities that do not hold the corresponding RBAC role on the Azure Machine Learning workspace.
Unexpected creation, modification, or deletion of compute clusters, pipelines, models, or datasets by low-privileged users.
Sign-ins from atypical IP addresses or service principals followed by Azure Machine Learning API calls that exceed the principal's documented entitlements.
Outbound data transfers from Azure Machine Learning storage accounts to destinations outside approved networks.

Detection Strategies

Enable Microsoft Defender for Cloud coverage for Azure Machine Learning and review alerts for anomalous workspace operations.
Stream Azure Activity Logs, Azure Machine Learning diagnostic logs, and Microsoft Entra ID sign-in logs to a SIEM and correlate user role with the operation performed.
Build detections that flag privileged Azure Machine Learning REST API calls (/workspaces/*/computes, /workspaces/*/jobs, /workspaces/*/datastores) made by principals lacking Contributor or AzureML Data Scientist rights.

Monitoring Recommendations

Continuously monitor Microsoft Entra ID role assignments scoped to Azure Machine Learning resources and alert on unexpected grants.
Track Azure Machine Learning compute creation events and validate them against approved automation identities.
Review egress traffic from training compute and inference endpoints to identify exfiltration of models or datasets.

How to Mitigate CVE-2025-49747

Immediate Actions Required

Confirm that the Microsoft service-side fix has propagated to all regions hosting your Azure Machine Learning workspaces by reviewing the Microsoft CVE-2025-49747 Advisory.
Audit RBAC assignments on each Azure Machine Learning workspace and remove identities that do not require access.
Rotate credentials and access keys for service principals and managed identities that have interacted with affected workspaces.
Review Azure Activity Logs for the last 90 days to identify unauthorized privileged operations.

Patch Information

Microsoft remediated CVE-2025-49747 at the cloud service layer. Customers do not need to install a binary update. Verify that workspaces created or modified before the publication date have not received unauthorized changes. Refer to the Microsoft CVE-2025-49747 Advisory for official guidance and customer obligations.

Workarounds

Apply the principle of least privilege using built-in Azure Machine Learning roles (Reader, AzureML Data Scientist, AzureML Compute Operator) rather than broad Contributor assignments.
Restrict workspace access to private endpoints and disable public network access where feasible.
Require Microsoft Entra ID Conditional Access policies, including multifactor authentication, for any identity interacting with Azure Machine Learning.
Enable customer-managed keys and resource locks on production workspaces to limit the blast radius of any privilege escalation.

bash

# Restrict Azure Machine Learning workspace to private network access
az ml workspace update \
  --name <workspace-name> \
  --resource-group <resource-group> \
  --public-network-access Disabled

# Audit role assignments scoped to the workspace
az role assignment list \
  --scope /subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.MachineLearningServices/workspaces/<workspace-name> \
  --output table