This vulnerability in Azure API Management (APIM) is classified as CWE-284: Improper Access Control. It enables an attacker who already has high privileges to execute code remotely over the network. The CVSS 3.1 base score is 8.0, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and no user interaction required. Microsoft has published an official fix and manages patching for this cloud-hosted service. No specific affected versions are stated, consistent with the nature of a cloud service.

An authorized attacker with high privileges can execute arbitrary code remotely on the Azure API Management service, potentially leading to full compromise of the service's confidentiality, integrity, and availability. This could affect API management operations and any dependent applications or services.

Microsoft has released an official fix for this vulnerability and manages remediation for Azure API Management as a cloud service. Customers should ensure their Azure APIM instances are updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35425. No additional customer action is required beyond applying the official fix as directed by Microsoft.