CVE-2025-59273 is a high severity (CVSS 7.3) improper access control vulnerability in Microsoft Azure Event Grid that lets an unauthorized attacker elevate privileges over a network. Read the MSRC entry to confirm whether any customer action is needed. The sections below cover who is affected, how to check, and what to do now.
What's affected
The record names Microsoft Azure Event Grid and gives no version range. The description says improper access control in Azure Event Grid allows an unauthorized attacker to elevate privileges over a network.
I could not load the MSRC advisory, so affected configurations and any fix should be confirmed there.
How to check if you're exposed
Microsoft publishes this entry in the Security Update Guide. I could not load the MSRC page from the command line, so I am not going to state details it contains. Open the entry for CVE-2025-59273 and read three things: whether it says the issue is already mitigated in the service, whether any customer action is listed, and which versions or configurations it names.
Then check your own side. List the Event Grid resources in your subscriptions, and look at who holds roles on them and which identities and network paths can reach them.
az resource list --resource-type "Microsoft.EventGrid/topics" --output table
What to do now
- Read the MSRC entry for CVE-2025-59273 and note whether any customer action is required.
- Inventory your Event Grid resources and the identities that can manage or use them.
- Apply least privilege to role assignments on those resources and remove stale ones.
- Turn on diagnostic logging for the resources and send it somewhere you review.
- Record the date you reviewed the entry so the next audit can see it was done.
Why it matters
The record maps this to CWE-284, improper access control. The vector shows network access with no privileges and no user interaction needed, with low impact on confidentiality, integrity and availability. The attacker is described as unauthorized, which is why the privileges required value is none.
Event Grid routes events between services, so access control around topics and subscriptions is the right place to look in your own environment. Check who can publish to a topic and who can create subscriptions, and prefer managed identities over shared keys. It is not on the CISA KEV list.
Authorization flaws are different from authentication flaws. The user may be properly logged in, yet the application fails to check whether that user is allowed to perform the specific action. These bugs are common in APIs because every endpoint has to repeat the check, and one missing check is enough.
The most useful test is to try each privileged action as an ordinary user and as an anonymous one, and confirm the server refuses both. Automated tests that do this for every route catch the regression the next time someone adds an endpoint.
A dependency scan will not see this one, because it concerns a product or service rather than a package in your code. The practical step is an asset inventory that records which of these products you run, which version, and who owns it. You can look up the record for this CVE in the Safeguard Gold directory and use the free scan at gold.safeguard.sh/scan for the software you build yourself.
Quick check
Is a patch available for CVE-2025-59273?
The record lists none. Check the MSRC entry for how Microsoft addressed it.
What should I review on my own Event Grid topics?
Who can publish, who can subscribe, whether shared access keys are in use, and whether public network access is needed.
Sources
- Microsoft MSRC entry for CVE-2025-59273 (listed in the record)
- NVD record data
Last reviewed: 18 October 2026.
