Azure Container Apps Remote Code Execution Vulnerability

The impact of CVE-2025-65037 is severe. Successful exploitation allows an attacker to gain complete control over the affected Azure Container Apps environment. This could lead to data breaches, system compromise, and the potential for lateral movement within the broader Azure infrastructure. An attacker could leverage this RCE to install malware, steal sensitive data, or disrupt services. The ability to execute code over a network significantly expands the attack surface and increases the potential blast radius, potentially impacting multiple tenants and applications.

Organizations heavily reliant on Azure Container Apps for deploying and managing containerized applications are at significant risk. This includes those using legacy deployments of versions 1.0.0 and earlier, as well as those with less stringent network security configurations. Shared hosting environments utilizing Azure Container Apps are also particularly vulnerable.

• azure / container:

Get-AzContainerApp | Where-Object {$_.Version -lt '2.5.4'}

• azure / container: Monitor Azure activity logs for suspicious processes or commands executed within container apps. • azure / container: Review network security group rules to ensure minimal necessary access to container apps. • azure / container: Check for unusual network traffic patterns originating from container apps.

1. 2025-12-18Disclosure

   disclosure

1. 已保留2025-11-13
2. 发布日期2025-12-18
3. 修改日期2026-04-16
4. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2025-65037 is to upgrade Azure Container Apps to version 2.5.4 or later. If immediate upgrading is not feasible, consider implementing network segmentation to restrict access to the vulnerable service. Review and tighten access controls to limit the potential attack surface. While a direct WAF rule is unlikely to be effective against code injection, implementing strict input validation and output encoding within your containerized applications can help reduce the risk. Monitor Azure activity logs for suspicious code execution patterns.