CVE-2025-64656 is a critical (CVSS 9.4) out-of-bounds read in Azure Application Gateway, published on 26 November 2025. It lets an unauthorized attacker elevate privileges over a network. Microsoft's data states that customer action is not required, but confirm that on the update guide.
What's affected
The NVD record has no version list, which fits a cloud service that Microsoft runs for you. The description says an out-of-bounds read in Application Gateway allows an unauthorized attacker to elevate privileges over a network. The CVSS vector shows network access, low complexity, no privileges and no user interaction, with high confidentiality and integrity impact and low availability impact.
Microsoft's update guide entry is titled "Azure Application Gateway Elevation of Privilege Vulnerability". It reports the flaw as not publicly disclosed and not exploited at publication, states that customer action is not required, and gives a base score of 9.4 with a temporal score of 8.2.
How to check if you're exposed
There is no version to check for a managed service. Do two things instead. First, open the MSRC page for CVE-2025-64656 and read the customer action field. As of our review it says none is required.
Second, confirm which of your workloads sit behind Application Gateway so you can scope the impact if guidance changes. With the Azure CLI:
az network application-gateway list --query "[].{name:name,rg:resourceGroup,sku:sku.name}" -o table
Review each gateway's listeners and the back end pools they front. Check that diagnostic logging is on so that you can look back if Microsoft later publishes indicators.
What to do now
- Open the MSRC page for CVE-2025-64656 and confirm the customer action status.
- List your Application Gateway instances and the applications behind them.
- Make sure access and WAF logs are enabled and retained for a sensible period.
- Keep your back end applications patched anyway. A gateway is one layer, not the only one.
- Subscribe to MSRC updates, and revisit the CVE if Microsoft revises the entry.
Why it matters
The record lists CWE-125, out-of-bounds read. A program reads memory beyond the buffer it should be limited to, which can expose data or influence what happens next. In a gateway that handles all inbound traffic for an application, memory safety bugs are especially sensitive.
The odd part is the stated impact. An out-of-bounds read is usually described as information disclosure, yet Microsoft classes this as elevation of privilege. We have no further detail and will not speculate. The record does not mark the CVE as known exploited. Microsoft says it was not exploited at publication, and that no customer action is needed, because the fix is applied on the service side.
Quick check
Is there a version I should upgrade to?
No. This is a Microsoft managed service, and the data says customer action is not required.
Is the flaw being exploited?
Microsoft's entry says not exploited at the time of publication. It is not in the CISA Known Exploited Vulnerabilities catalog per the record.
Sources
Last reviewed: 18 October 2026.
