CVE-2026-40412
This vulnerability allows anyone on the network to upload a file of a dangerous type to Azure Orbital Spatio and execute code on the system. Because no authentication or user interaction is required, an attacker can take full control of the affected instance. The flaw is due to missing file type validation.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Microsoft Azure Orbital Spatio services, all versions that have not applied a patch. The typical user is an organization using Azure Orbital Spatio for space data processing.
Real-world impact
An attacker could upload a malicious file, execute arbitrary code, steal data, modify or delete files, and potentially take over the entire Azure Orbital Spatio environment.
Why this severity
The CVSS score of 10 reflects that the attack can be performed over the network without any credentials, and it gives the attacker full confidentiality, integrity, and availability compromise. The vector shows no authentication, no user interaction, and a scope change, which together produce the maximum score.
What to do about it
- ›Restrict file uploads to approved types and extensions.
- ›Validate file content before processing.
- ›Monitor logs for suspicious upload activity.
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources.
Timeline
- May 22, 2026 · May 22, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…vendor advisory