CVE-2026-35425: Azure API Management RCE Vulnerability

CVE-2026-35425 Overview

CVE-2026-35425 is an improper access control vulnerability in Azure API Management (APIM). An authorized attacker can leverage the flaw to execute code over a network against affected APIM instances. Microsoft has published guidance through the Microsoft Security Response Center.

The issue is categorized under [CWE-284] Improper Access Control. Successful exploitation impacts confidentiality, integrity, and availability, and the scope changes to affected components beyond the vulnerable one. Attack complexity is high and elevated privileges are required, which constrains trivial exploitation.

Critical Impact
An authenticated attacker with sufficient privileges can execute code across trust boundaries in Azure API Management, compromising hosted APIs and downstream services.

Affected Products

Azure API Management (APIM)
Microsoft Azure cloud service (APIM component)
Refer to the Microsoft Security Update Guide for the authoritative list of impacted APIM configurations

Discovery Timeline

2026-07-24 - CVE-2026-35425 published to the National Vulnerability Database
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-35425

Vulnerability Analysis

CVE-2026-35425 stems from improper access control within Azure API Management. The service fails to consistently enforce authorization boundaries between tenants, roles, or management-plane operations. An attacker who already holds valid credentials can invoke functionality that should be restricted.

Because the scope changes upon exploitation, code execution reaches components beyond the vulnerable APIM instance. This can include backend APIs proxied through APIM, policy expressions, or shared infrastructure controlled by the gateway. The vulnerability supports network-based attacks against the APIM control or data plane.

The elevated attack complexity indicates that exploitation requires specific conditions, such as targeted configuration states or precise timing. The requirement for high privileges limits exposure to actors who already possess management or contributor-level access to APIM resources.

Root Cause

The root cause is mapped to [CWE-284] Improper Access Control. Authorization checks in APIM do not fully validate whether an authenticated principal is permitted to perform the requested operation. Microsoft has not published low-level technical details beyond the security advisory.

Attack Vector

Exploitation occurs over the network against APIM endpoints. The attacker authenticates with legitimate but limited credentials, then invokes a request path that bypasses authorization to trigger code execution. See the Microsoft Security Update Guide for advisory content.

No public proof-of-concept exploit or exploit database entry is currently associated with this CVE. The vulnerability manifests through the APIM request-handling path. Refer to Microsoft's advisory for exploitation prerequisites.

Detection Methods for CVE-2026-35425

Indicators of Compromise

Unexpected code execution events, spawned processes, or outbound connections originating from Azure API Management managed identities or backend workloads.
API Management audit logs showing successful privileged operations from principals that historically only performed read operations.
Anomalous policy modifications, custom expression edits, or named-value changes in APIM tenants without corresponding change-management tickets.

Detection Strategies

Enable Azure Diagnostic Settings on APIM and stream GatewayLogs and AuditLogs to a SIEM for correlation against baseline user and role behavior.
Monitor Azure Activity Log entries related to Microsoft.ApiManagement/service/* write operations and cross-reference against approved change windows.
Alert on APIM policy definitions that introduce inline script execution, arbitrary outbound HTTP calls, or references to newly created named values.

Monitoring Recommendations

Continuously review role assignments on APIM resources and remove standing privileged access that is not required for daily operations.
Track Entra ID sign-ins for accounts with APIM contributor or owner roles and alert on anomalous locations, devices, or impossible travel.
Integrate APIM telemetry into a centralized data lake to enable retroactive threat hunting once additional indicators become public.

How to Mitigate CVE-2026-35425

Immediate Actions Required

Apply the mitigations and updates documented in the Microsoft Security Update Guide for CVE-2026-35425.
Audit and reduce role assignments on Azure API Management resources, removing unused Contributor, Owner, and API Management Service Contributor roles.
Rotate APIM subscription keys, named values, and any credentials referenced by policies that may have been exposed during the vulnerability window.

Patch Information

Azure API Management is a managed service, so Microsoft applies platform-level fixes directly to the service backbone. Customers should confirm remediation status through the Microsoft Security Update Guide and validate that their APIM instances reflect the updated service version. Customer-side configuration hardening remains required even after platform patching.

Workarounds

Enforce Conditional Access and require phishing-resistant multi-factor authentication for all identities holding APIM management roles.
Restrict APIM management-plane access to specific networks using private endpoints, service tags, and Azure Policy deny rules on public exposure.
Apply the principle of least privilege by moving day-to-day operators to custom roles that exclude policy-editing and service-modification permissions.

bash

# Example: list current role assignments on an APIM instance and remove unused privileged assignments
az role assignment list \
  --scope /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG>/providers/Microsoft.ApiManagement/service/<APIM_NAME> \
  --output table

az role assignment delete \
  --assignee <PRINCIPAL_ID> \
  --role "API Management Service Contributor" \
  --scope /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RG>/providers/Microsoft.ApiManagement/service/<APIM_NAME>