CVE-2026-21227 is a high severity path traversal flaw (CVSS 8.2) in Microsoft Azure Logic Apps that lets an unauthorized attacker elevate privileges over a network. The record names no versions. Read the Microsoft Security Response Center entry to confirm whether you need to act.
What's affected
The record names Microsoft Azure Logic Apps and gives no version ranges. The weakness is CWE-22 (improper limitation of a pathname to a restricted directory). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. The record says the issue allows an unauthorized attacker to elevate privileges over a network.
The only reference is the Microsoft Security Response Center entry. That page is rendered by script, and its content did not load when I reviewed it, so I could not confirm affected configurations, fixed versions or whether customers have steps to take. Do not assume either way. The record does not mark the issue as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Start with the Microsoft advisory for CVE-2026-21227, which states whether the fix is applied by Microsoft or needs something from you.
Then list what you run. With the Azure CLI, the commands below show Logic Apps in a subscription. The first needs the logic extension, and the second lists Standard plan logic apps.
az logic workflow list --output table
az logicapp list --output table
Note which of them are reachable from the internet through HTTP triggers, and who can call them.
What to do now
- Open the Microsoft advisory for CVE-2026-21227 and follow its guidance for your plan type.
- List every Logic App in your subscriptions, with its plan type and trigger type.
- Limit who can call HTTP triggers. Use IP restrictions and authentication on triggers where the service supports it.
- Review managed identities and connections that your workflows use, and remove any permission that a workflow does not need.
- Look at the activity logs for unusual calls to workflows and for changes to workflow definitions.
Why it matters
Path traversal happens when a service builds a file path from input and fails to stop special path elements from reaching outside the intended folder. The attacker then reads or writes files that the designer never meant to expose. On a cloud service, those files can include configuration and secrets that belong to the platform or to other workflows.
The scoring here has high confidentiality impact, so the main fear is disclosure of data or credentials, with those credentials then used for more. That is why the record says elevation of privileges. Least privilege for workflow identities limits how far a stolen credential goes, whatever the cause.
Quick check
Is this exploited in the wild?
The record does not say so and CISA does not list it. The Microsoft entry did not load for me, so check it for the current status.
Sources
- Microsoft Security Response Center entry for CVE-2026-21227 (listed in the record; the page content did not load during review)
- NVD record for CVE-2026-21227
Last reviewed: 19 October 2026.
