CVE-2026-70200 is a critical (CVSS 10.0) path traversal flaw in Azure Logic Apps that lets an unauthorized attacker elevate privileges over a network. The record names no fixed version. Read the Microsoft Security Update Guide entry to see whether Microsoft has already fixed it and whether your tenant needs to act.
What's affected
The record lists one product, Microsoft Azure Logic Apps, and gives no version numbers. Logic Apps is a hosted service, so a fix may be applied by Microsoft rather than by you. The Microsoft page is a JavaScript application that I could not read as plain text, so the remediation wording has to be confirmed there.
The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. In plain terms: reachable over the network, low complexity, no privileges, no user interaction, and the impact crosses a security boundary (scope changed). Confidentiality and integrity impact are high, availability is not affected.
How to check if you're exposed
Start by listing what you run, since exposure depends on whether you use the service at all.
az resource list --resource-type Microsoft.Logic/workflows --output table
That lists consumption logic apps in the current subscription. Standard (single tenant) logic apps appear as Microsoft.Web/sites resources whose kind includes workflowapp, so check those in the portal as well. Repeat for every subscription you own.
Then open the Microsoft advisory and look for the sections that say what, if anything, customers must do.
What to do now
- Inventory every Logic Apps resource across your subscriptions, including Standard plan apps.
- Open the Microsoft advisory for CVE-2026-70200 and follow any customer action it lists.
- If the advisory says the service is already fixed, record that and the date for your own tracking.
- Review which managed identities and connections your workflows use, and remove access they do not need.
- Check activity logs for unexpected changes to workflows or connections since the publish date, 17 September 2026.
Why it matters
The record maps this to CWE-22, path traversal, and CWE-285, improper authorization. Path traversal happens when a service builds a file location from input without confining it to the intended directory. Improper authorization means a check that should have stopped the request was missing or wrong.
The scope change in the vector is the part to take seriously. A flaw in a shared integration service can expose more than the one workflow, because workflows hold connections and credentials to other systems. The record does not say it is exploited, and its KEV flag is false.
Quick check
Is CVE-2026-70200 known to be exploited?
The record's KEV flag is false and nothing in it describes exploitation. Treat that as a snapshot and recheck the Microsoft advisory.
Sources
Last reviewed: 19 October 2026.
