CVE-2025-30389 is a high severity (CVSS 8.7) improper authorization flaw in the Azure Bot Framework SDK. The record says an unauthorized attacker can elevate privileges over a network. I could not read Microsoft's guide, so check it for affected and fixed versions.
What's affected
The record lists the Azure AI Bot Service and the Azure Bot Framework SDK as affected and gives no version numbers. I could not load the Microsoft update guide when preparing this post, so I cannot list affected packages or fixed releases.
Bot Framework SDKs exist for several languages, and the guide should say which packages to update. Check it before assuming that a package is in or out of scope.
The record does not flag the CVE as known exploited (not in the CISA KEV catalog at the time of writing).
How to check if you're exposed
Find where you use Bot Framework packages.
- For .NET, run dotnet list package and look for Microsoft.Bot packages.
- For JavaScript, run npm ls botbuilder and related packages.
- For Python, run pip list and look for botbuilder packages.
- Compare any versions found with the fixed versions in the Microsoft guide.
Also look at how your bot authenticates callers and which identities it uses to call other services.
What to do now
- Read the MSRC guide for CVE-2025-30389 and note affected packages and fixed versions.
- Update Bot Framework SDK packages in every bot project, then rebuild and redeploy.
- Review the permissions of the identity the bot uses, and remove anything it does not need.
- Check bot logs and the Azure activity log for unexpected calls or configuration changes.
- Add the SDK packages to your software inventory so that you can find them next time.
Why it matters
The record maps the flaw to CWE-285 (Improper Authorization). In general terms, the software does not correctly check whether a caller is allowed to take an action, so someone without the right permissions can do more than intended. The record does not give more detail, so I will not guess at the mechanism.
A bot often sits between users and internal services, with its own identity and access. A privilege escalation flaw in the SDK that powers it can therefore reach beyond the bot itself. A high score here follows from network reach and the lack of required privileges.
Update tooling and least privilege both help. Keep the bot's identity narrow so that a flaw in the framework gives away less.
Quick check
Which packages are affected?
The record does not say. Check Microsoft's guide for the list.
Does least privilege help?
Yes. A narrowly scoped bot identity limits what a privilege escalation can reach.
Sources
Last reviewed: 19 October 2026.
