CVE-2026-83944 is a maximum severity (10.0) improper access control flaw in Microsoft Azure Logic Apps that lets an unauthorized attacker elevate privileges over a network. The record gives no versions or fix details, and I could not read Microsoft's page, so check the Security Update Guide for what your tenant must do.
What's affected
The record lists Microsoft Azure Logic Apps and gives no version numbers. Azure Logic Apps is a cloud service, and Microsoft often fixes service flaws on its side. I could not read the Microsoft Security Update Guide page for this CVE, so I cannot say whether customers must act.
Open the guide entry for CVE-2026-83944 and read its customer action section.
How to check if you're exposed
Open https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83944 in a browser and read what Microsoft says about affected components and any customer steps.
In your own tenant, list the Logic Apps you run, especially Standard plan apps that you host and manage, and note which have public triggers or broad access policies.
What to do now
- Read Microsoft's entry for CVE-2026-83944 and note any customer action.
- List your Logic Apps and their triggers, connections and access control settings.
- Review role assignments on the resource groups and Logic Apps and remove access that is no longer needed.
- Restrict inbound trigger access to the IP ranges that need it where the service allows.
- Check activity logs for changes you did not make.
Why it matters
The weakness is CWE-284, improper access control. The record says an unauthorized attacker could elevate privileges over a network. The vector lists no privileges, no user interaction and a changed scope, which together give the highest possible score of 10.0.
Logic Apps often holds connections and credentials to many other systems, so a privilege flaw there can reach well beyond one app. The record is not listed in CISA's KEV catalog. Microsoft's description is one sentence, so treat the details as unknown until the guide says more.
A score of 10.0 draws attention, and it should. But the record has very little detail, and the right response is to find out what Microsoft says, not to guess. For a cloud service, Microsoft may have fixed the issue on its side, in which case customers have nothing to install. In other cases, customers must change settings or update components they run themselves, such as Standard plan apps with self managed hosting.
While you read the guide, use the time to tighten what you control. Logic Apps connections often carry credentials with wide reach. Review which connections each workflow uses, who can edit workflows and who can read run histories, since run histories can contain data.
If you manage many subscriptions, a quick inventory of Logic Apps with public triggers is worth building anyway. It will pay off for the next advisory too.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to patch an Azure service myself?
Not always. Microsoft fixes many service flaws centrally. Read the customer action in the Security Update Guide to be sure.
Sources
Last reviewed: 19 October 2026.
