Microsoft Rejects Critical Azure Vulnerability Report, No CVE

A security researcher claims Microsoft quietly patched a critical Azure Backup for AKS vulnerability. The researcher alleges Microsoft rejected his initial report and declined to issue a CVE, despite his documentation of a subsequent silent fix. Microsoft, however, disputes these claims, telling BleepingComputer that the observed behavior was “expected” and that “no product changes were made.”

This situation highlights a recurring tension between security researchers and major vendors. When a researcher identifies a critical flaw, a silent fix without a CVE can leave defenders in the dark. It prevents proper tracking, risk assessment, and validation of patches, forcing organizations to rely on opaque vendor statements rather than transparent vulnerability disclosures. This isn’t just a process dispute; it directly impacts an organization’s ability to manage its attack surface effectively.