This vulnerability, identified as CWE-284 (Improper Access Control), exists in Microsoft Azure API Management (APIM). It permits an attacker who is already authorized with high privileges to execute code remotely over the network, potentially leading to complete compromise of confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 8.0, reflecting high impact with network attack vector, high attack complexity, and no user interaction required. Microsoft has released an official fix for this cloud-hosted service, and remediation is managed by the vendor.

An attacker with authorized high privileges can execute arbitrary code remotely, resulting in full compromise of confidentiality, integrity, and availability of the Azure API Management environment. This could lead to unauthorized data access, modification, or service disruption.

Microsoft has provided an official fix for this vulnerability and manages remediation for the cloud-hosted Azure API Management service. Users should ensure their service instances are updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35425. No additional user action is required beyond applying the official fix.