[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flemSV7X80mUUpxuV4UolTmept9vVTM-vkY2Z8l_3ruE":3},{"article":4,"iocs":49,"watch_terms":50,"solutions":51,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"24bfddfa-97ba-49b1-8e6a-7bb3b67501c7","Default Azure Automation Setting Enables Cross-Tenant Identity Takeover","default-azure-automation-setting-enables-cross-tenant-identity-takeover-0ece18","Microsoft addressed a public-by-default configuration and chain of code flaws in Azure Automation which could have let attackers seize another tenant's identity and access other tenants' data, credentials, and cloud workloads.","Microsoft has patched a critical vulnerability in Azure Automation that, when chained with other code flaws, allowed attackers to take over identities in other tenants. This could have led to unauthorized access to sensitive data, credentials, and cloud workloads across different Azure environments.","Azure Automation flaw allowed cross-tenant identity takeover and data access.","https:\u002F\u002Fwww.darkreading.com\u002Fcloud-security\u002Fdefault-azure-automation-setting-cross-tenant-identity-takeover","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fbltee2b6459a49ecef3\u002F64f171e51bf536263bbf9b29\u002FAzure_SOPA_Images_Limited_Alamy.jpg?width=720&quality=80&disable=upscale","2026-07-24T12:48:16+00:00","2026-07-24T16:00:20.721232+00:00",8,[17,20,23,26],{"name":18,"type":19},"Azure Automation","product",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"identity","technology",{"name":27,"type":25},"cloud","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":52,"vendors":135},[53,81,109],{"slug":54,"name":55,"problem":56,"products":57},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":54,"product_name":78,"url":79,"description":80},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":82,"name":83,"problem":84,"products":85},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[86,94,101],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":95,"vendor_name":21,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"slug":110,"name":111,"problem":112,"products":113},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[114,122,127],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":95,"vendor_name":21,"vendor_logo":96,"product_slug":123,"product_name":124,"url":125,"description":126},"defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",[136],{"slug":95,"name":21,"logo_path":96,"roles":137},[138],"affected",{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":156},"azure-automation-default-setting-enabled-cross-tenant-identity-takeover","Azure Automation Default Setting Enabled Cross-Tenant Identity Takeover","A critical vulnerability in Azure Automation stemmed from an insecure default configuration that, when combined with additional code flaws, allowed attackers to hijack identities across different Azure tenants. Default settings that grant excessive permissions are particularly dangerous in multi-tenant cloud environments because a single misconfiguration can expose not just one organization but many. This incident highlights that cloud services should follow the principle of least privilege by default, not as an optional hardening step. Organizations must never assume that vendor defaults are secure, especially in shared or federated cloud infrastructure where trust boundaries are inherently complex.",[144,145,146,147,148,149,150,151,152,153,154,155],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 5: Account Management","CIS Control 6: Access Control Management","NIST SP 800-53 AC-2: Account Management","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 IA-4: Identifier Management","Azure Security Benchmark: PA-1 Protect and Limit Highly Privileged Users","Azure Security Benchmark: IM-1 Use Centralized Identity and Authentication System","GDPR Article 25: Data Protection by Design and by Default","GDPR Article 32: Security of Processing",{}]