CVE-2026-50338

Azure Spring Apps Elevation of Privilege Vulnerability

CVSS 8.2 HIGHCWE-287

Vexday Risk Score

38Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS 8.2EPSS —KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado

Lifecycle

14 Jul 2026Published on NVD

14 Jul 2026Public PoC

Weaponization speed

same dayto first PoC

Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.

Recommendation: Plan a near-term fix — a public PoC already exists.

Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network.

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C

Affected products

public PoCs found — 1

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References