CVE-2025-59503

The SSRF vulnerability allows an attacker to induce a vulnerable server to send specially crafted network requests on their behalf, bypassing access control mechanisms. In the case of Azure Compute Gallery, this flaw is remotely accessible over the network without requiring any privileges (PR:N, UI:N). The scope of the attack extends beyond the boundary of the original component (S:C), indicating potential impact on resources outside the direct context of the service. Successful exploitation of the vulnerability can lead to privilege escalation in the cloud environment.

An attacker can obtain privilege escalation in the Azure environment, which combined with the full CIA triad (C:H/I:H/A:H) indicates potential loss of confidentiality, integrity, and availability of cloud resources. The lack of authentication requirements makes this vulnerability exceptionally dangerous for organizations using Azure Compute Gallery.

Apply patches available from the vendor according to references published by Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59503. As a service managed by Microsoft, updates may be deployed on the Azure platform side — administrators should verify the status in the MSRC portal and monitor Microsoft service messages regarding Azure Compute Gallery.

Microsoft Azure Compute Resource Provider — Azure Compute Gallery; versions indicated in vendor references