CVE-2025-59503 CRITICAL

CVE-2025-59503: Azure Compute Resource Provider Elevation of Privilege Vulnerability

Vendor Microsoft
Product Azure Compute Resource Provider
Weakness CWE-918 · SSRF
Published October 23, 2025
Last update February 26, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C

What the vulnerability does

01Description

Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network.

Key dates

02Disclosure timeline

October 23, 2025 CVE published
February 26, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-21885 Miniflux Media Proxy SSRF via /proxy endpoint allows access to internal network resources CVE-2026-43526 OpenClaw < 2026.4.12 - Server-Side Request Forgery via QQBot Reply Media URL Handling CVE-2026-41302 OpenClaw < 2026.3.31 - Server-Side Request Forgery via Unguarded fetch() in Marketplace Plugin Download CVE-2024-5031 MemberPress <= 1.11.29 - Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode CVE-2026-39922 GeoNode SSRF via Service Registration