{"id":"CVE-2025-24986","aliases":["EUVD-2025-6353","GHSA-gprr-v9f2-px3c","PYSEC-2026-1804","PYSEC-2026-2968"],"status":"published","title":"Azure Promptflow Remote Code Execution Vulnerability","description":"Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00539,"percentile":0.458,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-653"],"published":"2025-03-11T16:58:59Z","modified":"2026-07-13T16:43:17Z","fixes":[{"ecosystem":"PyPI","package":"promptflow-tools","fixed_in":["1.6.0"],"sources":["ghsa","osv"]},{"ecosystem":"PyPI","package":"promptflow-core","fixed_in":["1.17.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"promptflow-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"promptflow-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"promptflow-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}],"versions":["0.1.0b1","0.1.0b10","0.1.0b11","0.1.0b12","0.1.0b15","0.1.0b5","0.1.0b6","0.1.0b8","0.1.0b9","1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0","1.3.0","1.4.0","1.5.0"]},{"source":"osv","ecosystem":"PyPI","package":"promptflow-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.2"}]}],"versions":["0.1.0b1","1.10.0","1.10.1","1.11.0","1.12.0","1.13.0","1.14.0","1.15.0","1.15.0.post1","1.15.1","1.16.0","1.16.1","1.16.2","1.17.0","1.17.1","1.8.0","1.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"promptflow-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.2"}]}],"versions":["0.1.0b1","1.10.0","1.10.1","1.11.0","1.12.0","1.13.0","1.14.0","1.15.0","1.15.0.post1","1.15.1","1.16.0","1.16.1","1.16.2","1.17.0","1.17.1","1.8.0","1.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"promptflow-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}],"versions":["0.1.0b1","0.1.0b10","0.1.0b11","0.1.0b12","0.1.0b15","0.1.0b5","0.1.0b6","0.1.0b8","0.1.0b9","1.0.0","1.0.1","1.0.2","1.0.3","1.1.0","1.2.0","1.3.0","1.4.0","1.5.0"]}],"products":[{"vendor":"microsoft","product":"azure promptflow-core"},{"vendor":"microsoft","product":"azure promptflow-tools"},{"vendor":"microsoft","product":"azure_promptflow_core"},{"vendor":"microsoft","product":"azure_promptflow_tools"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24986","tags":["vendor-advisory","patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24986","tags":["advisory"]},{"url":"https://github.com/microsoft/promptflow/commit/5f4a41ab4cb15607ade7f26138b0b863b4e4eb0a","tags":["web"]},{"url":"https://github.com/microsoft/promptflow/commit/625061724c51533d28fe6e0e3014b1042afdb07f","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gprr-v9f2-px3c","tags":["advisory"]},{"url":"https://github.com/microsoft/promptflow","tags":["package"]},{"url":"https://pypi.org/project/promptflow-core","tags":["package"]},{"url":"https://pypi.org/project/promptflow-tools","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-24986","title":"Azure Promptflow Remote Code Execution Vulnerability","description":"Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.","status":"published","published":"2025-03-11T16:58:59.571Z","modified":"2026-02-13T19:38:40.809Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C","level":"medium","assessor":"cna"}],"cwes":["CWE-653"],"updated_at":"2026-11-02T14:32:43.770144Z"}],"euvd":[{"id":"EUVD-2025-6353","description":"Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.","status":"published","published":"2025-03-11T16:58:59Z","modified":"2026-02-13T19:38:40Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C","level":"medium"}],"updated_at":"2026-11-02T19:48:39.007067Z"}],"ghsa":[{"id":"GHSA-gprr-v9f2-px3c","title":"Azure PromptFlow remote code execution related to Jinja templates","description":"Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.","status":"published","published":"2025-03-11T18:32:18Z","modified":"2025-03-11T20:19:56Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-653"],"updated_at":"2026-11-02T14:38:34.185137Z"}],"nvd":[{"id":"CVE-2025-24986","description":"Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.","status":"published","published":"2025-03-11T17:16:34.563Z","modified":"2026-06-17T08:59:55.973Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-653"],"updated_at":"2026-11-02T14:10:53.93104Z"}],"osv":[{"id":"GHSA-gprr-v9f2-px3c","title":"Azure PromptFlow remote code execution related to Jinja templates","description":"Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.","status":"published","published":"2025-03-11T18:32:18Z","modified":"2026-07-13T16:43:17.482107065Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-653"],"updated_at":"2026-11-02T15:46:48.191583Z"},{"id":"PYSEC-2026-1804","title":"Azure PromptFlow remote code execution related to Jinja templates","description":"Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.","status":"published","published":"2026-07-07T14:34:50.579144Z","modified":"2026-07-13T16:43:17.482107065Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.06457Z"},{"id":"PYSEC-2026-2968","title":"Azure PromptFlow remote code execution related to Jinja templates","description":"Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.","status":"published","published":"2026-07-13T14:36:33.6221Z","modified":"2026-07-13T16:43:17.482107065Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:56.429374Z"}]}}