CVE-2026-83944 CRITICAL

CVE-2026-83944: Azure Logic Apps Elevation of Privilege Vulnerability

Vendor Microsoft

Product Azure Logic Apps

Weakness CWE-284

Published September 17, 2026

Last update September 19, 2026

View on NVD All CVEs

CVSS base score

10.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C

What the vulnerability does

01Description

Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

Key dates

02Disclosure timeline

September 17, 2026 CVE published

September 19, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-83944 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/284.html AskarLabs — CWE-284 write-up Improper Access Control

Related vulnerabilities

04Related CVE

CVE-2026-48957 Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints CVE-2026-65758 Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 CVE-2026-48947 Joomla! Core - [20260701] - Incorrect Access Control in com_media webservice endpoints CVE-2026-65759 Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 CVE-2024-13693 Enfold <= 6.0.9 - Missing Authorization to Sensitive Information Disclosure in avia-export-class.php