Microsoft azure functions vulnerabilities

Latest Microsoft azure functions CVEs

Newest publication first

1. CVE-2026-21532 Azure Function Information Disclosure Vulnerability

   Published 2026-02-05

   High·CVSS 8.2 EPSS 0.89%

   Azure Function Information Disclosure Vulnerability

2. CVE-2025-33074 Azure Functions Remote Code Execution Vulnerability

   Published 2025-04-30

   High·CVSS 8.8 EPSS 0.60%

   Improper verification of cryptographic signature in Microsoft Azure Functions allows an authorized attacker to execute code over a network.

3. CVE-2024-49052 Microsoft Azure PolicyWatch Elevation of Privilege Vulnerability

   Published 2024-11-26

   Critical·CVSS 9.8 EPSS 0.70%

   Missing authentication for critical function in Microsoft Azure PolicyWatch allows an unauthorized attacker to elevate privileges over a network.

4. CVE-2024-38204 Imagine Cup site Information Disclosure Vulnerability

   Published 2024-10-15

   Medium·CVSS 6.5 EPSS 0.94%

   Improper access control in Imagine Cup allows an authorized attacker to elevate privileges over a network.

5. CVE-2020-16904 Azure Functions Elevation of Privilege Vulnerability

   Published 2020-10-16

   Critical·CVSS 9.8 EPSS 3.4%

   <p>An elevation of privilege vulnerability exists in the way Azure Functions validate access keys.</p> <p>An unauthenticated attacker who successfully exploited this vulnerability could invoke an HTTP Function without proper authorization.</p> <p>This security update addresses th...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.