CVE-2025-62207 Azure Monitor Elevation of Privilege Vulnerability
An attacker can exploit Server-Side Request Forgery in Azure Monitor to escalate privileges within the cloud service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-62207?
CVE-2025-62207 is a high-severity server-side request forgery vulnerability in Microsoft Azure Monitor Control Service, published on 20 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Azure Monitor Elevation of Privilege Vulnerability
Weakness: CWE-918
Which versions are affected by CVE-2025-62207?
It affects 1 product.
Products include Microsoft Azure Monitor.
How do I fix CVE-2025-62207?
No fix has been published for CVE-2025-62207 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-62207 being exploited?
There is no known exploitation of CVE-2025-62207 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Azure Monitor Control Service
Sources
Also known as GHSA-j3rp-fv9f-6v63.