Microsoft's 'By Design' Vulnerability: When Cloud Vendors Sidestep Security Disclosure

Microsoft's rejection of a critical cross-tenant vulnerability in Azure as 'by design' exposes a dangerous gap in cloud security disclosure practices. Without a CVE identifier, enterprises cannot systematically track and remediate the risk, leaving millions of Azure customers potentially exposed to active exploitation. This precedent-breaking decision undermines the coordinated vulnerability disclosure ecosystem and signals that vendors may selectively reclassify serious flaws rather than patch them—eroding trust in cloud platforms.