A critical vulnerability in Microsoft Planetary Computer Pro could allow a remote, unauthenticated attacker to gain elevated privileges. The issue was reported as CVE-2026-63508 with a CVSS score of 10.0, the maximum possible value.
The listing concerns the Planetary Computer Pro (GeoCatalog), which provides catalog and geospatial data infrastructure on Azure. The SecNews technical team evaluated the available data from NVD and the corresponding Microsoft listing.
See also: Critical vulnerability in Azure Kubernetes Service
What does the vulnerability mean in Microsoft Planetary Computer Pro?
The vulnerability is classified as CWE-306, which means a critical operation is missing authentication. Simply put, this operation can accept a request from the network without first verifying who is sending it. The result is the possibility of elevation of privilege in an environment hosted on Azure.
The CVSS vector confirms that the attack is network-based, with low complexity, and without prior privileges or user interaction. The scope varies, while the impact on confidentiality and integrity is rated as high. Availability is not included in the assessment, but the privilege violation could impact directory data and operations.
This doesn't mean that every Azure account has already been compromised. It does mean that an exposed resource using Microsoft Planetary Computer Pro needs immediate review. Organizations should review which environments have the service enabled, which accounts have access, and whether there have been any unusual requests before applying the fix.
Why the lack of identification increases the risk
In a geospatial data service, the elevated privileges of Microsoft Planetary Computer Pro are not necessarily limited to reading a map. If the offending operation can modify directories, roles, or settings, an attacker could create persistent access or affect applications that consume the data. The ultimate extent depends on the configuration of each organization.
CVE-2026-63508 is rated critical, but available public data does not list affected versions or technical proof of an exploit. The NVD entry shows the status as "Received" and associates the issue with a hosted service only. Therefore, it is not safe to assume that an OS or local server update fixes the issue.
See also: Microsoft's fixes on previous Patch Tuesday
Practical steps for administrators
Administrators should open the official CVE-2026-63508 on the Microsoft Security Response Center and follow the instructions that apply to their specific Azure tenant. Until the fix is confirmed, it is prudent to restrict access to the affected interfaces, enforce the strictest network rules available, and temporarily remove unnecessary permissions.
At the same time, log files should be checked for requests to Planetary Computer Pro from unknown addresses, failed access attempts, and changes to roles or directories. Comparison with the organization's usual activity may reveal indications of abuse, but is not in itself proof of a breach.
Microsoft has not publicly disclosed details of an exploit in the wild, nor have specific actors been reported as victims. For this reason, security teams should not rely on speculation or unconfirmed third-party guidance. The safest approach is to verify the situation directly with Azure and the MSRC.
See also: Critical vulnerabilities in cloud infrastructure services
CVE-2026-63508 shows how important authentication is even in services that operate as fully managed platforms. The SecNews technical team recommends recording the dependencies of each application on Planetary Computer Pro, reviewing permissions, and keeping logs available for possible investigation.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Organizations that do not use the service can mark the CVE for monitoring purposes, without making changes to unrelated systems. For those that do, the priority is to confirm the fix from official Microsoft, limit exposure, and look for suspicious changes to accounts and data directories.
