Microsoft has successfully patched a critical vulnerability dubbed “SynLapse,” which impacts the Azure cloud platform’s Data Factory and Synapse Pipelines. If exploited, this vulnerability could allow an attacker running jobs in a Synapse pipeline to perform Remote Code Execution (RCE) across the Integration Runtime (IR). The successful exploitation could allow malicious attackers to pilfer sensitive data like service certificates/keys, passwords, and API tokens, ultimately gaining access and control of other customers’ Synapse instances. The flaw, tracked as CVE-2022-29972, specifically exists in the third-party Open Database Connectivity (ODBC) driver utilized for connecting with Amazon Redshift in the IR computing infrastructure used by Azure. Although this flaw has been patched, researchers from Orca Cloud Security state that they have repeatedly bypassed the security fixes, suggesting that the weaknesses lie in the general architecture of Azure Synapse and Data Factory. Microsoft urges all of their Data Factory and Synapse customers to update to the latest stable version immediately, as well as configuring a Managed Virtual Network to isolate their workspaces from the internet. At this time there is no evidence that this flaw has been exploited In-the-Wild, and the CTIX team will continue to track this matter, providing updates as needed.