CVE-2026-62834 is a critical (CVSS 9.3) improper cryptographic signature verification flaw in Azure Data Factory that lets an unauthorized attacker elevate privileges over a network. The record names no version. Read the Microsoft entry for any customer action and review who can edit pipelines.
What's affected
- Product: Microsoft Azure Data Factory.
- Description in the record: improper verification of cryptographic signature allows an unauthorized attacker to elevate privileges over a network.
- Fixed version: the record gives no version, since this is a cloud service. Microsoft's entry is the place to confirm whether you need to do anything.
- Weakness: CWE-347, improper verification of cryptographic signature. CVSS 9.3, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N.
How to check if you're exposed
Cloud service flaws like this are normally remediated by the provider, and the record names no customer action. I could not load Microsoft's entry, so confirm there whether anything is required of you. Whatever the answer, these checks are worth running.
az datafactory list --query "[].{name:name,rg:resourceGroup}" -o table
What to do now
- Open the Microsoft entry and note any required customer action.
- List who has contributor or data factory roles on each factory, and trim anyone who does not need them.
- Review linked service credentials and prefer managed identities over stored secrets.
- Turn on diagnostic logs for pipeline runs and review them for runs you did not expect.
- Be careful with links and requests that ask a signed in user to approve something in the service, since the vector includes user interaction.
Why it matters
A signature check proves that data came from the party it claims. When verification is incomplete, an attacker can present data as trusted that is not. The vector for this record includes user interaction and a changed scope, so a signed in person is part of the picture.
The weakness is CWE-347. Data Factory moves data between systems and holds credentials for them, which raises the stakes of any privilege escalation. The record's KEV flag is false. As a cloud service issue, the provider side fix carries no version number.
Quick check
Is a customer patch needed?
The record names no version. Check Microsoft's entry to confirm.
Does this need a user to do something?
The CVSS vector includes user interaction.
Sources
- Microsoft Security Response Center entry (listed in the record, but it did not load when I reviewed it)
Last reviewed: 19 October 2026.
