CVE-2026-40411
Microsoft Azure Virtual Network Gateway has a critical flaw that lets an attacker run code on the gateway. The vulnerability is caused by improper input validation, which can be exploited by anyone who can send crafted data to the gateway. It is a serious risk for anyone using Azure’s virtual networking services.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Microsoft Azure Virtual Network Gateway (all versions).
Real-world impact
An attacker who can send data to the gateway can run arbitrary code, potentially taking control of the gateway and compromising the network traffic that passes through it.
Why this severity
The CVSS score of 9.9 reflects that the attack is network‑based, requires low effort, and gives the attacker high privileges. The vector shows that the attacker can exploit the flaw remotely (AV:N), with low complexity (AC:L) and low privileges (PR:L), no user interaction (UI:N), and the impact is complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 22, 2026 · May 22, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…vendor advisory