CVE-2026-62874 CRITICAL

CVE-2026-62874: Azure Billing Elevation of Privilege Vulnerability

Vendor Microsoft

Product Azure Billing

Weakness CWE-345

Published September 17, 2026

Last update September 29, 2026

View on NVD All CVEs

CVSS base score

10.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L/E:U/RL:O/RC:C

What the vulnerability does

01Description

Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.

Key dates

02Disclosure timeline

September 17, 2026 CVE published

September 29, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-62874 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/345.html AskarLabs — CWE-345 write-up Insufficient Verification of Data Authenticity

Related vulnerabilities

04Related CVE

CVE-2026-2428 Fluent Forms Pro Add On Pack <= 6.1.17 - Missing Authorization to Unauthenticated Payment Status modification CVE-2026-8608 Event Monster <= 2.1.0 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via em_capture_payment AJAX Action CVE-2025-14444 RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.9 - Unauthenticated Payment Bypass via rm_process_paypal_sdk_payment CVE-2024-1321 EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment Bypass CVE-2026-28145 WordPress MasterStudy LMS plugin <= 3.7.39 - Broken Access Control vulnerability