Microsoft Azure Web Apps vulnerabilities

3 CVEs affecting Microsoft Azure Web Apps, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-65816, published 2026-08-20.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-38194, published 2024-09-10. Critical severity, CVSS 9.9. EPSS: 1.3% chance of exploitation in the next 30 days. An authenticated attacker can exploit an improper authorization vulnerability in Azure Web Apps to elevate privileges over a network.
• CVE-2026-32211, published 2026-04-03. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network.
• CVE-2026-65816, published 2026-08-20. Critical severity, CVSS 10.0. EPSS: 1% chance of exploitation in the next 30 days. Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.