Azure Machine Learning CVE-2025-49746: Critical Privilege Escalation via Improper Authorization

Introduction

One mistake in cloud authorization logic can expose an organization's most valuable AI assets. In July 2025, a critical flaw in Microsoft Azure Machine Learning (Azure ML) broke the trust boundary between authenticated users and privileged operations. Attackers could use it to take control of sensitive ML workloads and data. CVE-2025-49746 has a CVSS score of 9.9, and every enterprise that relies on cloud-based machine learning pipelines should pay attention to it.

About Azure Machine Learning: Microsoft Azure is one of the world's leading cloud providers and runs critical workloads for Fortune 500 companies and startups. Azure Machine Learning is its main platform for building, deploying, and managing ML models at scale. Thousands of organizations use it, for work as different as fraud detection and autonomous systems.

Technical information

CVE-2025-49746 is a classic case of improper authorization (CWE-285) in Azure ML's access control subsystem. The vulnerability lets an authenticated attacker, meaning someone with legitimate but limited access, escalate their privileges over the network and perform actions reserved for higher-privilege roles.

Vulnerability mechanism

• Improper authorization checks: The flaw is in how Azure ML enforces RBAC (Role-Based Access Control) boundaries. Under certain conditions, the service does not properly validate user permissions when it processes API requests or delegates tasks between linked Azure resources.
• Attack vector: Exploitation requires network access and valid credentials (user or service principal). Attackers craft API calls or manipulate resource delegation flows to get around the intended restrictions.
• Impact: Successful exploitation grants SYSTEM-level access to ML compute instances, managed inference endpoints, and potentially the MLflow Model Registry. Attackers can:
  • Exfiltrate proprietary model architectures
  • Poison training datasets
  • Inject malicious code into inference endpoints

Affected components:

• Azure ML Compute Instances (all versions prior to July 18, 2025)
• Managed Inference Endpoints (especially with custom authentication modules)
• MLflow Model Registry integrations with Azure Active Directory

No public proof-of-concept or detection signatures are available yet. Microsoft has not disclosed the vulnerable code. What is known is that the root cause is a gap in RBAC enforcement during cross-service operations.

Patch information

Microsoft has deployed backend fixes for CVE-2025-49746 in all Azure regions. Azure ML is a managed service, so Microsoft handles patching and no manual patch is required. Customers must still validate that their resources run the latest version, and they should review their access policies.

To check the service version, open the Azure Portal, go to Machine Learning > Properties > Service Version, and confirm that your environment is up to date (post-July 18, 2025).

For further details, see the Microsoft Security Advisory and Azure ML Vulnerability Management.

Affected systems and versions

• Azure Machine Learning Compute Instances: All versions prior to July 18, 2025
• Managed Inference Endpoints: All versions prior to July 18, 2025
• MLflow Model Registry (Azure AD integrations): All versions prior to July 18, 2025

The available advisories list no other Azure services as affected.

Vendor security history

Microsoft Azure has had several critical vulnerabilities in 2025, many of them in ML and AI services:

• CVE-2025-30390: Privilege escalation in Azure ML Compute (April 2025)
• CVE-2025-21415: Authentication bypass in Azure AI Face Service
• CVE-2025-32711: Zero-click data exfiltration in Copilot AI

Microsoft's average patch latency for cloud services is under 48 hours, and its security advisories are detailed and transparent. Still, the repeated problems with RBAC and cross-service delegation show how hard cloud-native ML environments remain to secure.

References

• NVD Entry for CVE-2025-49746
• Microsoft Security Advisory
• IntegSec Analysis: AI at Risk
• Azure ML Vulnerability Management

Source: This report was created using AI

If you have suggestions for improvement or feedback, please email us at [email protected]