CVE-2025-64675 is a high severity (CVSS 8.3) cross-site scripting flaw in Azure Cosmos DB, published on 19 December 2025. An unauthorized attacker can perform spoofing over a network. Microsoft's data says customer action is not required, but check the update guide for revisions.
What's affected
The NVD record names Azure Cosmos DB and describes improper neutralization of input during web page generation that allows an unauthorized attacker to perform spoofing over a network. There is no version list, which fits a service that Microsoft operates.
Microsoft's update guide entry is titled "Azure Cosmos DB Spoofing Vulnerability". It reports that the issue was not publicly disclosed and not exploited at publication, and that customer action is not required. It rates the flaw Critical, whereas the CVSS base score of 8.3 sits in the High band, so you may see both labels. The CVSS vector needs a user interaction, which fits an attack that depends on someone opening a crafted page or link.
How to check if you're exposed
You cannot check a version on a managed service. Open the MSRC page for CVE-2025-64675 and read the customer action field. As of our review, none is required.
For your own records, list Cosmos DB accounts in your subscriptions so you know what the advisory may touch:
az cosmosdb list --query "[].{name:name,rg:resourceGroup}" -o table
Also review who can sign in to the Azure portal or any Cosmos DB web based tooling in your organization, and make sure those accounts use multi factor authentication. Because the attack form is spoofing through a web page, user habits matter here: sign in only from bookmarked addresses and be careful with links.
What to do now
- Confirm in the MSRC page for CVE-2025-64675 that customer action is not required.
- Inventory your Cosmos DB accounts and who administers them.
- Enforce multi factor authentication for portal and data plane administrators.
- Remind staff to open the Azure portal from bookmarks, not from links in messages.
- Re-check the advisory later in case Microsoft revises the guidance.
Why it matters
The record lists CWE-79, cross-site scripting. It comes from output that is not made safe for a web page, so injected markup runs in the victim's browser. For a database service whose management interface holds keys and settings, a spoofing flaw can be used to trick an operator.
We have no more detail than the advisory gives. Microsoft says it was not exploited at publication. The record does not mark it as known exploited. The service side fix means your main work is to confirm the status and keep operator accounts well protected.
Quick check
Does this mean my data was exposed?
Nothing in the record or Microsoft's entry says so. The entry says the flaw was not exploited at publication.
Why is it High here but Critical at Microsoft?
The CVSS base score of 8.3 is High. Microsoft's own severity label is Critical. They describe the same flaw.
Sources
Last reviewed: 18 October 2026.
