CVE-2025-47988

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Improper control of generation of code ('code injection') in Azure Monitor Agent allows an unauthorized attacker to execute code over an adjacent network.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jul 8, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-479897.0Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.CVE-2025-47997.2The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the directory a file can CVE-2025-479917.8Use after free in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.CVE-2025-479937.8Improper access control in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.CVE-2025-479948.6Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally.CVE-2025-479958.8Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.CVE-2025-479967.8Integer underflow (wrap or wraparound) in Windows MBT Transport driver allows an authorized attacker to elevate privileges locally.CVE-2025-479975.3Concurrent execution using shared resource with improper synchronization ('race condition') in SQL Server allows an authorized attacker to d CVE-2025-479988.8Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a networ CVE-2025-479996.8Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.CVE-2025-48008.8The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stm_lms_ad CVE-2025-480007.8Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.