What’s Vulnerable › Vulnerabilities

CVE-2025-49707: Azure Virtual Machines Spoofing Vulnerability

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-12 · updated 2026-06-17
• Weakness: CWE-284

Description

Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally.

Affected products

• Microsoft Dcadsv5-Series Azure Vm Firmware: all versions
• Microsoft Dcasv5-Series Azure Vm Firmware: all versions
• Microsoft Dcedsv5-Series Azure Vm Firmware: all versions
• Microsoft Dcesv5-Series Azure Vm Firmware: all versions
• Microsoft Dcesv6-Series Azure Vm Firmware: all versions
• Microsoft Ecadsv5-Series Azure Vm Firmware: all versions
• Microsoft Ecasv5-Series Azure Vm Firmware: all versions
• Microsoft Ecedsv5-Series Azure Vm Firmware: all versions
• Microsoft Ecesv5-Series Azure Vm Firmware: all versions
• Microsoft Ecesv6-Series Azure Vm Firmware: all versions
• Microsoft Nccadsh100V5-Series Azure Vm Firmware: all versions
• Microsoft DCadsv5-series Azure VM: all versions
• Microsoft DCasv5-series Azure VM: all versions
• Microsoft DCedsv5-series Azure VM: all versions
• Microsoft DCesv5-series - Azure VM: all versions
• Microsoft DCesv6-series Azure VM: all versions
• Microsoft ECadsv5-series Azure VM: all versions
• Microsoft ECasv5-series Azure VM: all versions
• Microsoft ECedsv5-series Azure VM: all versions
• Microsoft ECesv5-series Azure VM: all versions
• Microsoft Ecesv6-series Azure VM: all versions
• Microsoft NCCadsH100v5-series Azure VM: all versions

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49707

Get alerted when CVE-2025-49707 or the next vulnerability affects your stack