A Critical Azure Automation Flaw Exposed Accounts to Identity Takeovers
Microsoft has addressed a serious vulnerability in its Azure Automation service that could have allowed attackers to seize another tenant’s identity and access sensitive data, credentials, and cloud workloads. The flaw, discovered by a senior security researcher on Microsoft’s Azure Networking Security Research team, exploited a default setting that made account identities publicly accessible.
The issue affects organizations using Azure Automation for DevOps, resource deployment, patching, and secrets rotation. The service is widely used by enterprises running Azure, and its accounts typically hold privileged identities. An attacker with access to their own Azure Automation account could breach the trust boundary and assume another tenant’s automation identity, enabling them to create or modify scripts and access sensitive configuration data or credentials.
The vulnerability was discovered last year and reported to Microsoft’s Security Response Center (MSRC), which issued an advisory. The flaw, known as Azure Automation Elevation of Privilege Vulnerability (CVE-2025-29827), has a CVSS score of 9.9, indicating its severity. A successful attacker could create, change, or delete resources across an organization’s cloud workloads.
Shay Shavit, the researcher who discovered the vulnerability, plans to demonstrate its impact at next month’s Black Hat USA conference in Las Vegas. In his demonstration, he will show how the default configuration poses a risk to Microsoft and its customers. “When the default is public, then you can access a lot of accounts, potentially,” Shavit explains.
The exploit chain consisted of three distinct flaws: the default configuration that made Azure Automation accounts publicly accessible, plus two separate code-level bugs. This vulnerability highlights how subtle misconfigurations and logic flaws can be chained to enable high-impact attacks. Shavit recommends that organizations avoid exposing anything external unless there’s a specific need to do so, and lower their risk by auditing the scope of identities and tokens assigned to cloud automation accounts.
This is not the first vulnerability discovered in Azure Automation. In 2021, researchers at Orca Security found a flaw that could exfiltrate managed identity tokens from a shared sandbox server. While the two vulnerabilities share the same goal – extracting a victim’s managed identity – the attack chains differ. The finding serves as a reminder of the importance of securing cloud infrastructure and monitoring for potential misconfigurations.
To protect against similar attacks, organizations should review their Azure Automation configurations and ensure that account identities are not publicly accessible unless required. Regular auditing and monitoring can help identify potential vulnerabilities before they are exploited. By taking proactive steps to secure their cloud environments, organizations can reduce the risk of identity takeovers and data breaches.
Source: Dark Reading — 2026-07-24