Microsoft Fixes Major Cloud Security Bugs Across Azure Ecosystem
On May 9, 2025, Microsoft released fixes for four significant security flaws found within key Azure services—including DevOps, Automation, Storage, and Power Apps—that posed serious risks to cloud infrastructure integrity.
While none of the vulnerabilities are known to have been exploited, their technical severity and potential for privilege escalation spotlight the growing attack surface in modern cloud-native environments. These issues also reinforce the importance of continuous security hygiene and role-based access control across distributed systems.
Exposing Hidden Pathways in Azure Pipelines and Automation
The highest-risk flaw, tagged CVE-2025-29813 and rated CVSS 10.0, involved a critical privilege escalation pathway within Azure DevOps pipelines. Attackers with project-level permissions could manipulate temporary job tokens to gain persistent, broader access. The issue originated from mishandled token logic in Visual Studio, now corrected by Microsoft engineers through refined access token governance.
Another issue—CVE-2025-29827, with a CVSS score of 9.9—was found in Azure Automation. This flaw bypassed key authorization checks, enabling authenticated users to elevate permissions, especially hazardous in shared tenancy environments. The problem tied back to a breakdown in permission validation processes, classified under CWE-285 (Improper Authorization).
Backdoors in Azure Storage and Power Apps
In Azure Storage, CVE-2025-29972 (CVSS 9.9) enabled server-side request forgery (SSRF) attacks. Exploiting this, a legitimate user could impersonate services or access unauthorized data—highlighting the continued dangers of SSRF vectors in cloud APIs.
Finally, Power Apps suffered from CVE-2025-47733 (CVSS 9.1), a no-authentication-required flaw allowing data exposure through similar SSRF techniques. Its lack of access control at the entry point marked it as particularly dangerous if left unresolved.
Securing the Cloud’s Expanding Edges
These vulnerabilities illustrate how deeply integrated services can introduce systemic risk. As enterprise adoption of cloud platforms deepens, maintaining visibility across inter-service trust boundaries becomes essential—not just for defense, but for resilience.
Summary of Critical Azure & Power Platform Vulnerabilities
1. CVE-2025-29813 – Azure DevOps (Visual Studio)
- Type: Privilege Escalation
- Risk Level: Critical (CVSS 10.0)
- Attack Vector: An attacker with access to a project—without needing prior elevated privileges—could manipulate pipeline job tokens. By exchanging a short-lived token for a long-term one, they could extend their control across project environments.
2. CVE-2025-29827 – Azure Automation
- Type: Privilege Escalation
- Risk Level: Critical (CVSS 9.9)
- Attack Vector: A low-privileged, authenticated user could abuse authorization flaws to elevate access levels. This is particularly dangerous in multi-tenant setups where isolation failures pose systemic risks.
3. CVE-2025-29972 – Azure Storage Resource Provider
- Type: Spoofing via Server-Side Request Forgery (SSRF)
- Risk Level: Critical (CVSS 9.9)
- Attack Vector: An authorized attacker could craft malicious SSRF requests, masquerading as other services or users, potentially granting unauthorized access to data or internal resources.
4. CVE-2025-47733 – Microsoft Power Apps
- Type: Information Disclosure via SSRF
- Risk Level: Critical (CVSS 9.1)
- Attack Vector: No authentication required. This flaw allows unauthenticated attackers to exploit SSRF mechanisms, exposing sensitive information without needing user credentials.
Microsoft Closes Critical Cloud Flaws Behind the Scenes—No Action Required
Although three of the recently disclosed vulnerabilities in Microsoft’s cloud stack earned CVSS scores above 9.0, the company has confirmed that all threats were neutralized before the public ever heard about them—requiring no customer involvement whatsoever.
According to Microsoft, these risks were resolved entirely at the platform level, with mitigations deployed seamlessly across affected services like Azure DevOps, Automation, Storage, and Power Apps. In an official statement, Microsoft clarified:
“These vulnerabilities have been comprehensively addressed by our internal teams. No end-user remediation is required. Disclosure is provided in the interest of transparency.”
This reflects a broader cultural shift in cloud security norms, driven by Microsoft’s transparency program introduced in June 2024. Under this policy, the company commits to disclosing high-severity vulnerabilities—even when customers aren’t impacted directly or asked to take corrective action.
By decoupling disclosure from remediation necessity, Microsoft is pushing the cloud security ecosystem toward greater accountability and shared visibility. Where cloud providers once limited CVE announcements to user-relevant threats, this approach prioritizes industry-wide awareness of infrastructure-layer risks.
Even with behind-the-scenes fixes, security-conscious organizations continue to monitor their cloud architecture carefully. As attack methods evolve and service interdependencies grow more complex, transparency and early warning signals remain essential to staying one step ahead.
