CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NCVE-2025-24986
Medium (6.5) in microsoft. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in promptflow-tools 1.6.0.
Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
- CWE
- CWE-653
- Published
- Modified
- Record from
- the NVD, synced
Affected
- microsoft:azure_promptflow_core
- microsoft:azure_promptflow_tools
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-gprr-v9f2-px3c | PyPI | promptflow-tools | <1.6.0 | 1.6.0 |
| GHSA-gprr-v9f2-px3c | PyPI | promptflow-core | <1.17.2 | 1.17.2 |
| PYSEC-2026-1804 | PyPI | promptflow-core | <1.17.2 | 1.17.2 |
| PYSEC-2026-2968 | PyPI | promptflow-tools | <1.6.0 | 1.6.0 |