Microsoft Azure Logic Apps vulnerabilities

8 CVEs affecting Microsoft Azure Logic Apps, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-83944, published 2026-09-17.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-36019, published 2023-12-12. High severity, CVSS 7.4. EPSS: 15.8% chance of exploitation in the next 30 days. Microsoft Power Platform Connector Spoofing Vulnerability
• CVE-2026-69400, published 2026-08-20. Critical severity, CVSS 9.6. EPSS: 0.9% chance of exploitation in the next 30 days. Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-42823, published 2026-05-12. Critical severity, CVSS 9.9. EPSS: 0.8% chance of exploitation in the next 30 days. Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.
• CVE-2026-32171, published 2026-04-14. High severity, CVSS 8.8. EPSS: 0.8% chance of exploitation in the next 30 days. Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.
• CVE-2026-56161, published 2026-08-07. Critical severity, CVSS 9.6. EPSS: 0.7% chance of exploitation in the next 30 days. Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.
• CVE-2026-70200, published 2026-09-17. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-21227, published 2026-01-22. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-83944, published 2026-09-17. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.