← Vulnerability feed
Start free
Open in platform
Vulnerability record · CVE-2023-36019 · published 12 December 2023
CVE-2023-36019: Microsoft azure logic apps vulnerability
Microsoft · Azure Logic Apps
Microsoft Power Platform Connector Spoofing Vulnerability
7.4 CVSS 3.1 High EPSS 16% · top 3.2% CWE-73 · CWE-73
7.4CVSS 3.1 base score
16%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD
Description
Microsoft Power Platform Connector Spoofing Vulnerability
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36019 | PatchVendor Advisory |
| https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36019 | PatchVendor Advisory |
Track CVE-2023-36019 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
9.9CVE-2026-65818Microsoft power platform server-side request forgery (ssrf) vulnerabilityServer-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.EPSS 0.63%9.9CVE-2026-42823Microsoft azure logic apps improper access control vulnerabilityImproper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.EPSS 0.78%9.8CVE-2026-70200Microsoft azure logic apps path traversal vulnerabilityImproper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privile…EPSS 0.60%9.8CVE-2026-21227Microsoft azure logic apps path traversal vulnerabilityImproper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privile…EPSS 0.56%9.8CVE-2024-35260Microsoft power platform untrusted search path vulnerabilityAn authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network.EPSS 0.83%9.6CVE-2026-69400Microsoft azure logic apps path traversal vulnerabilityImproper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privile…EPSS 0.94%9.6CVE-2026-56161Microsoft azure logic apps improper access control vulnerabilityImproper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.EPSS 0.69%9.1CVE-2026-83944Microsoft azure logic apps improper access control vulnerabilityImproper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.EPSS 0.44%
Source: NIST National Vulnerability Database (record CVE-2023-36019), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
