Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Azure App Service for Linux enables remote code execution

CVE-2026-77900 · published 19 days ago
Summary

A function in Azure App Service for Linux does not require authentication, so an attacker on the network could run their own code on the service. This could let them take control of the web app, steal data, or disrupt operations. Apply the latest security updates from Microsoft and review the service configuration to ensure all functions are properly protected.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft azure app service for linux -
Original advisory text
Azure App Service Remote Code Execution Vulnerability
Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published8 Oct 2026
Updated26 Oct 2026
First seen8 Oct 2026
Sources
CVE-2026-77900 · NVD
CVE-2026-77900 · MITRE
Track software like this
Free during beta