This vulnerability (CVE-2025-65037) in Microsoft Azure Container Apps is due to improper control of code generation, enabling remote code execution by an unauthenticated attacker. The CVSS 3.1 base score is 10.0, reflecting network attack vector, no required privileges or user interaction, and complete compromise of confidentiality, integrity, and availability. The vulnerability is categorized under CWE-94 (Code Injection). Although no specific affected versions are listed, the vendor has released a patch to address the issue. No exploits are currently known in the wild.

Successful exploitation allows an attacker to execute arbitrary code remotely on the affected Azure Container Apps environment, leading to full system compromise including complete loss of confidentiality, integrity, and availability. This could result in unauthorized data access, modification, or service disruption.

A patch is available from Microsoft to remediate this vulnerability. It is recommended to apply the official fix promptly to prevent exploitation. Since Azure Container Apps is not a cloud service in this context, customers must apply the patch themselves. There are no known exploits in the wild, but timely patching is critical due to the high severity.