🔴 Critical | Source: Microsoft Security Response Center
A remote code execution vulnerability in Azure API Management (APIM) allows an attacker who already has some level of authorised access to run arbitrary code over the network. Improper access controls are at the root of the flaw, meaning existing authentication is insufficient to contain the blast radius. This is particularly concerning given how widely APIM is used as a gateway to backend services and sensitive APIs.
Security Architect’s Take: Review your APIM instances immediately and apply any available Microsoft patches or mitigations. In the interim, restrict network access to APIM management endpoints using NSGs or private endpoints, and audit authorised identities to ensure least-privilege principles are enforced.
Original advisory: CVE-2026-35425 Azure API Management (APIM) Remote Code Execution Vulnerability