CVE-2026-62874 is a maximum severity (CVSS 10.0) flaw in Azure Billing. Insufficient verification of data authenticity lets an unauthorized attacker elevate privileges over a network. The record names no version. Read the Microsoft entry for any customer action and review who holds billing roles.
What's affected
- Product: Microsoft Azure Billing.
- Description in the record: insufficient verification of data authenticity allows an unauthorized attacker to elevate privileges over a network.
- Fixed version: the record gives no version, since this is a cloud service. Microsoft's entry is the place to confirm whether you need to do anything.
- Weakness: CWE-345, insufficient verification of data authenticity. CVSS 10.0, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L.
How to check if you're exposed
Cloud service flaws like this are normally remediated by the provider, and the record names no customer action. I could not load Microsoft's entry, so confirm there whether anything is required of you. Whatever the answer, these checks are worth running.
az billing account list --query "[].{name:name,displayName:displayName}" -o table
What to do now
- Open the Microsoft entry and note any required customer action.
- List who holds billing owner, billing contributor and similar roles, and remove anyone who does not need them.
- Review recent changes to billing accounts, invoice sections and payment details.
- Set up alerts on role assignment changes at the billing scope.
Why it matters
Billing looks like a back office feature, but it sits close to account ownership. Authenticity checks make sure data came from a trusted source and was not forged. The record says these checks were insufficient, with changed scope and high confidentiality and integrity impact.
The class is CWE-345. Because the service is run by the provider, there is no version to install. Your best moves are tight billing roles and change alerts. The record's KEV flag is false.
Quick check
Is there anything to install?
The record names no version. Check Microsoft's entry.
Why check billing roles?
Billing roles control account level settings, so keeping them small limits harm from any privilege problem.
Sources
- Microsoft Security Response Center entry (listed in the record, but it did not load when I reviewed it)
Last reviewed: 19 October 2026.
