CVE-2025-66390 Microsoft CVE debrief

Who should care

Defenders responsible for Azure API Management configurations and security should assess exposure and verify the configuration of self-service signup in their tenants. This includes reviewing the current state of self-service signup, ensuring proper disablement in tenants where necessary, and monitoring for potential exploitation attempts. Additionally, security teams and vulnerability management teams should prioritize verifying configurations, assessing

Why it matters

CVE-2025-66390 is a critical vulnerability in Microsoft Azure API Management that allows attackers to bypass self-service signup restrictions. Defenders should prioritize verifying configurations, assessing exposure, and monitoring for exploitation attempts.

• Verify configuration of self-service signup to prevent unauthorized access
• Assess exposure and potential impact on tenant isolation
• Monitor for potential exploitation attempts to detect possible attacks
• Ensure proper disablement of signup in tenants where necessary to prevent bypass

Technical summary

The vulnerability exists in Microsoft Azure API Management, allowing an attacker to reuse the registration flow by changing the hostname or tenant identifier to bypass self-service signup restrictions. The CVSS score is 9.8, indicating a critical vulnerability. This issue arises when self-service signup is enabled in one tenant (Tenant A) and an attacker can exploit this by changing the hostname or tenant identifier to target another tenant (Tenant B), even if Tenant B has signup disabled at the UI level. The underlying API endpoint still accepts cross-tenant requests based on the Host header, effectively bypassing the UI-level restriction. The supplier states that they evaluated the report and determined it is

Defensive priority

Defenders should prioritize verifying the configuration of self-service signup in Azure API Management and ensuring that signup is properly disabled in tenants where necessary.

Recommended defensive actions

• Verify the configuration of self-service signup in Azure API Management
• Ensure that signup is properly disabled in tenants where necessary
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE description and NVD entry provide details on the vulnerability, including its existence in Microsoft Azure API Management and the CVSS score. However, the scope of affected versions and remediation steps require verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.