Improper Access Control in Azure Resource Manager by Microsoft
CVE-2026-24304

9.9CRITICAL

Key Information:

Vendor

Microsoft
Status
Azure Resource Manager
Vendor
CVE Published:
23 January 2026

What is CVE-2026-24304?

The vulnerability in Azure Resource Manager pertains to improper access controls, which could potentially allow an authorized user to elevate their privileges within the network. This exploitation may lead to unauthorized actions being executed with higher privileges than intended. It’s crucial for users of Azure Resource Manager to be aware of this issue and apply any provided patches or updates to mitigate potential risks.

Affected Version(s)

Azure Resource Manager -

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.