- How many CVEs does Azure have?
- Azure has 36 published CVE records since 2019, including 15 in the last two years.
- How many Azure CVEs are in CISA KEV?
- Yes — 1 of Azure's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
- Which Azure products have the most CVEs?
- The Azure products with the most published CVEs are azure-iot-explorer, azure-cli, azure-uamqp-c, azure-sdk-for-java, azure-sdk-for-net.
- What are the most common weakness types in Azure CVEs?
- Azure's CVEs most often map to these CWE weakness types: CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection')), CWE-94 (Improper Control of Generation of Code ('Code Injection')), CWE-287 (Improper Authentication), CWE-502 (Deserialization of Untrusted Data).
- Are there public exploits for Azure vulnerabilities?
- Yes — 2 of Azure's CVEs have a known public exploit.
- How many critical Azure vulnerabilities are there?
- Azure has 9 critical and 17 high-severity CVEs.
- What is the average severity of Azure CVEs?
- The average CVSS base score across Azure's scored CVEs is 7.7.