CVE-2026-42823: Azure Logic Apps Privilege Escalation

CVE-2026-42823 Overview

CVE-2026-42823 is an improper access control vulnerability in Microsoft Azure Logic Apps. An authorized attacker can exploit the flaw over a network to elevate privileges within the affected environment. The weakness maps to [CWE-284] Improper Access Control and affects the Azure Logic Apps service offering.

Microsoft published the advisory through the Microsoft Security Response Center. The flaw enables a low-privileged authenticated principal to escalate privileges with a scope change, impacting confidentiality, integrity, and availability of resources beyond the initial security boundary.

Critical Impact
An authenticated attacker with low privileges can elevate access across the Azure Logic Apps trust boundary and obtain control over workflows, connectors, and integrated downstream services.

Affected Products

Microsoft Azure Logic Apps (CPE: cpe:2.3:a:microsoft:azure_logic_apps:-:*:*:*:*:*:*:*)
Workflows hosted on Azure Logic Apps standard and consumption plans
Connectors and integrations relying on Logic Apps identity context

Discovery Timeline

2026-05-12 - CVE-2026-42823 published to the National Vulnerability Database
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-42823

Vulnerability Analysis

The vulnerability resides in the access control logic of Azure Logic Apps. The service fails to correctly enforce authorization checks when an authenticated principal interacts with privileged workflow resources over the network. An attacker who already holds valid low-privilege credentials can issue requests that bypass these checks and gain elevated access.

Because Logic Apps orchestrates connectors that bridge to downstream Azure services, mailboxes, storage accounts, and SaaS platforms, a privilege escalation here propagates into linked resources. The scope change reflected in the CVSS vector indicates that successful exploitation impacts components beyond the vulnerable service itself.

The EPSS probability is 0.063% (percentile 19.7) as of 2026-05-17, indicating limited observed exploitation activity. However, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no public proof-of-concept is available at the time of publication.

Root Cause

The root cause is improper access control [CWE-284] within the Logic Apps authorization layer. The service does not adequately validate that the caller has rights to the target workflow, run history, or connection object before permitting privileged operations. This authorization gap allows escalation without requiring user interaction.

Attack Vector

The attack vector is network-based and requires existing low-privilege authentication to the Azure tenant. No user interaction is required. An attacker invokes Logic Apps management or runtime APIs with crafted parameters that target resources outside the attacker's authorized scope. See the Microsoft CVE-2026-42823 Advisory for the authoritative technical description.

Detection Methods for CVE-2026-42823

Indicators of Compromise

Unexpected Microsoft.Logic/workflows/* operations in Azure Activity Logs originating from low-privileged identities
Workflow run history showing actions executed under elevated managed identities without corresponding RBAC assignments
Anomalous modifications to Logic Apps connections, API connections, or integration accounts outside change windows
Logic Apps trigger invocations from unexpected IP ranges or service principals

Detection Strategies

Correlate Azure Activity Log entries with Entra ID sign-in logs to identify privilege escalation patterns tied to Logic Apps resource providers
Alert on creation or modification of Logic Apps workflows by accounts that historically only read or invoke runs
Monitor for newly granted role assignments on Logic Apps scopes immediately preceded by authentication anomalies

Monitoring Recommendations

Enable diagnostic settings on all Logic Apps to forward runtime and management logs to a centralized SIEM
Stream Azure Activity Logs and Microsoft Graph audit events to long-term storage for retrospective hunting
Establish baselines for Logic Apps API call volumes per identity and alert on deviations

How to Mitigate CVE-2026-42823

Immediate Actions Required

Review the Microsoft CVE-2026-42823 Advisory and apply Microsoft's service-side guidance
Audit all RBAC assignments on Logic Apps resources and remove unnecessary contributor or operator roles
Rotate credentials and connection secrets for high-value Logic Apps connectors
Review run history for the past 90 days for workflow executions inconsistent with business activity

Patch Information

Azure Logic Apps is a Microsoft-managed cloud service. Microsoft addresses the vulnerability through service-side updates rather than customer-installed patches. Customers should confirm remediation status through the Microsoft CVE-2026-42823 Advisory and verify their tenant configuration aligns with current Microsoft recommendations.

Workarounds

Enforce least-privilege RBAC on Logic Apps resource groups and restrict the Logic App Contributor and Logic App Operator roles
Require Conditional Access policies with phishing-resistant multi-factor authentication for any principal that manages Logic Apps
Use private endpoints and IP restrictions to limit network exposure of Logic Apps management and runtime endpoints
Segment integration accounts and managed identities so a single compromised workflow cannot pivot across the tenant

bash

# Example: list role assignments scoped to a Logic App for review
az role assignment list \
  --scope "/subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.Logic/workflows/<workflow-name>" \
  --output table