Microsoft Azure Automation vulnerabilities

4 CVEs affecting Microsoft Azure Automation, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-29827, published 2025-05-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-0962, published 2019-07-15. Medium severity, CVSS 4.9. EPSS: 4.3% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists in Azure Automation "RunAs account" runbooks for users with contributor role, aka 'Azure Automation Elevation of Privilege Vulnerability'.
CVE-2021-42306, published 2021-11-24. High severity, CVSS 8.1. EPSS: 3.3% chance of exploitation in the next 30 days. An information disclosure vulnerability manifests when a user or an application uploads unprotected private key data as part of an authentication certificate keyCredential  on an Azure AD Application…
CVE-2025-29827, published 2025-05-08. High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days. Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.
CVE-2024-21330, published 2024-03-12. High severity, CVSS 7.8. EPSS: 1% chance of exploitation in the next 30 days. Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability