From bleepingcomputer.com
Microsoft has released security updates to address a security flaw affecting Azure Synapse and Azure Data Factory pipelines that could let attackers execute remote commands across Integration Runtime infrastructure.
The Integration Runtime (IR) compute infrastructure is used by Azure Synapse and Azure Data Factory pipelines to provide data integration capabilities across network environments (e.g., data flow, activity dispatch, SQL Server Integration Services (SSIS) package execution).
The vulnerability (tracked as CVE-2022-29972 and dubbed SynLapse by Orca Security Tzah Pahima) was mitigated on April 15, with no evidence of exploitation before fixes were released.