CVE-2026-40412: Unrestricted Upload in Azure Orbital Spatio

CVE-2026-40412 is an unrestricted file upload flaw in Microsoft Azure Orbital Spatio, scored CVSS 10.0. The record says an unauthorized attacker can run code over a network. The MSRC entry is the source for remediation, so read it for any action your tenant needs.

What's affected

The NVD record names Microsoft Azure Orbital Spatio and gives no version ranges. The Microsoft Security Update Guide page is a script driven page that did not return text to my fetch, so I cannot report whether Microsoft has fixed this on the service side or what, if anything, customers must do.

Check the MSRC entry for the affected scope and any customer action. Cloud services are sometimes fixed by the provider without a customer step, and the entry says so when that is the case.

How to check if you're exposed

1. Open the MSRC page for CVE-2026-40412 and read the FAQ and remediation sections.
2. Check whether your organization uses Azure Orbital Spatio, through your Azure subscriptions and resource inventory.
3. If it is in use and the entry names a customer action, follow it.
4. Review who can upload content to the service and what happens to uploaded files.

What to do now

1. Confirm whether you use Azure Orbital Spatio at all.
2. Read the MSRC entry and follow its guidance.
3. Limit upload permissions and network access to the service.
4. Review recent uploads for files you do not recognise.

Why it matters

The weakness is CWE-434, unrestricted upload of a file with a dangerous type. When a service accepts files without limiting type and location, an uploaded file can end up somewhere it is later executed.

The maximum score reflects network access with no privileges, no interaction and changed scope. The record does not flag exploitation in the wild, and I found no text saying so.

Quick check

Sources

• Microsoft MSRC entry for CVE-2026-40412 (script driven page, not readable by my fetch)
• Gold page for this CVE

Last reviewed: 19 October 2026.