CVE-2025-59503 is a critical (CVSS 10.0) server side request forgery in Azure Compute Gallery, listed under the Azure Compute Resource Provider, that lets an unauthorized attacker elevate privileges over a network. Check the Microsoft MSRC entry for the fix status and any action.
What's affected
The record names the Microsoft Azure Compute Resource Provider and describes the flaw as SSRF in Azure Compute Gallery. No versions are given, because this is a cloud service.
I could not load the MSRC advisory, so fix status and any required customer step should be confirmed there. Do not assume that a 10.0 score means you must do something. It may or may not, and the advisory says which.
How to check if you're exposed
Microsoft publishes this entry in the Security Update Guide. I could not load the MSRC page from the command line, so I am not going to state details it contains. Open the entry for CVE-2025-59503 and read three things: whether it says the issue is already mitigated in the service, whether any customer action is listed, and which versions or configurations it names.
Then check your own side. List the Compute Gallery resources in your subscriptions, and look at who holds roles on them and which identities and network paths can reach them.
az resource list --resource-type "Microsoft.Compute/galleries" --output table
What to do now
- Read the MSRC entry for CVE-2025-59503 and note whether any customer action is required.
- Inventory your Compute Gallery resources and the identities that can manage or use them.
- Apply least privilege to role assignments on those resources and remove stale ones.
- Turn on diagnostic logging for the resources and send it somewhere you review.
- Record the date you reviewed the entry so the next audit can see it was done.
Why it matters
The record maps this to CWE-918, server side request forgery. SSRF means a server can be made to send requests on an attacker's behalf, often to internal addresses the attacker cannot reach directly. In cloud environments the sensitive target is frequently an internal metadata or management endpoint.
The 10.0 score comes from the vector: network access, low complexity, no privileges, no user interaction, a changed scope, and high impact on all three properties. Changed scope is what lifts it to the maximum, because the effect crosses a security boundary. The record has no exploitation information and it is not on the CISA KEV list.
Authorization flaws are different from authentication flaws. The user may be properly logged in, yet the application fails to check whether that user is allowed to perform the specific action. These bugs are common in APIs because every endpoint has to repeat the check, and one missing check is enough.
The most useful test is to try each privileged action as an ordinary user and as an anonymous one, and confirm the server refuses both. Automated tests that do this for every route catch the regression the next time someone adds an endpoint.
Server side request forgery is a good thing to test for in your own services. Any feature that fetches a URL on a user's behalf, such as a webhook, an image import or a link preview, should restrict which hosts and address ranges it will contact.
A dependency scan will not see this one, because it concerns a product or service rather than a package in your code. The practical step is an asset inventory that records which of these products you run, which version, and who owns it. You can look up the record for this CVE in the Safeguard Gold directory and use the free scan at gold.safeguard.sh/scan for the software you build yourself.
Quick check
Why does CVE-2025-59503 score 10.0?
Network access with no privileges or interaction, low complexity, a changed scope, and high impact on confidentiality, integrity and availability.
What is SSRF?
A flaw where a server can be induced to make requests to places the requester could not reach, often internal services.
Sources
- Microsoft MSRC entry for CVE-2025-59503 (listed in the record)
- NVD record data
Last reviewed: 18 October 2026.
