Vulnary
← back to the feed
Critical· 10

CVE-2026-40412

This vulnerability allows anyone on the network to upload a file of a dangerous type to Azure Orbital Spatio and execute code on the system. Because no authentication or user interaction is required, an attacker can take full control of the affected instance. The flaw is due to missing file type validation.

publishedMay 22, 2026
last modifiedJul 23, 2026
sourcesNVD
severity · cvss
10
critical · how bad it is
exploitation · epss
<1%
42th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 6, 2026

No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.

01

Who is affected

Microsoft Azure Orbital Spatio services, all versions that have not applied a patch. The typical user is an organization using Azure Orbital Spatio for space data processing.

02

Real-world impact

An attacker could upload a malicious file, execute arbitrary code, steal data, modify or delete files, and potentially take over the entire Azure Orbital Spatio environment.

03

Why this severity

The CVSS score of 10 reflects that the attack can be performed over the network without any credentials, and it gives the attacker full confidentiality, integrity, and availability compromise. The vector shows no authentication, no user interaction, and a scope change, which together produce the maximum score.

04

What to do about it

no official fix yet
interim mitigations
  • Restrict file uploads to approved types and extensions.
  • Validate file content before processing.
  • Monitor logs for suspicious upload activity.

No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.

No fix documented in sources.

05

Timeline

  1. May 22, 2026 · May 22, 2026
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Jul 23, 2026 · 12d ago
    Advisory updated
    The NVD record was last revised.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredNone
User interactionNone needed
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
07

References & advisories

(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
CVE-2026-40412: This vulnerability allows anyone on the network to upload a file of a · Vulnary