CVE-2025-65037: RCE in Azure Container Apps

The impact of CVE-2025-65037 is severe. Successful exploitation allows an attacker to gain complete control over the affected Azure Container Apps environment. This could lead to data breaches, system compromise, and the potential for lateral movement within the broader Azure infrastructure. An attacker could leverage this RCE to install malware, steal sensitive data, or disrupt services. The ability to execute code over a network significantly expands the attack surface and increases the potential blast radius, potentially impacting multiple tenants and applications.

1. Reserved2025-11-13
2. Published2025-12-18
3. Modified2026-04-16
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-65037 is to upgrade Azure Container Apps to version 2.5.4 or later. If immediate upgrading is not feasible, consider implementing network segmentation to restrict access to the vulnerable service. Review and tighten access controls to limit the potential attack surface. While a direct WAF rule is unlikely to be effective against code injection, implementing strict input validation and output encoding within your containerized applications can help reduce the risk. Monitor Azure activity logs for suspicious code execution patterns.