CVE-2026-40412

An unauthenticated attacker can upload a dangerous file type over the network to the vulnerable Azure Orbital Spatio component. The application does not sufficiently verify the type or content of the uploaded file, which allows malicious code to be placed and executed on the server side. The network vector (AV:N), lack of user interaction requirement (UI:N), and lack of required privileges (PR:N) make it possible to conduct the attack remotely and fully automatically.

Successful exploitation of this vulnerability gives an attacker the ability to execute arbitrary code remotely (RCE) in the service context, which with the scope C:H/I:H/A:H means complete breach of confidentiality, integrity and availability of data and the system. The scope of the vulnerability exceeds the component boundary (S:C), which may lead to lateral movement in the cloud environment.

Apply patches available from the vendor in accordance with the references published at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40412. Until the patch is applied, it is recommended to restrict network access to the vulnerable service only to trusted sources.

Azure Orbital Spatio — versions indicated in the vendor's references (Microsoft Security Response Center).