CVE Intelligence
Analysis AI-assisted

CVE-2026-24300: Microsoft Azure Front Door Elevation of Privilege

CVE-2026-24300 is a critical elevation of privilege vulnerability in Microsoft Azure Front Door, classified as improper access control (CWE-284), with a CVSS 3.1 base score of 9.8 reported by the CNA. The available record does not specify affected versions or fixed builds, so the Microsoft Security Update Guide is the primary source to consult. No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-24300 is described by Microsoft as an elevation of privilege vulnerability in Azure Front Door. The record maps it to improper access control (CWE-284). The CNA, Microsoft, published the record on 2026-02-05 and assigned a critical severity with a CVSS 3.1 base score of 9.8.

Impact

  • The CVSS vector indicates network attack vector, low complexity, no privileges required, and no user interaction required.
  • The vector scores high confidentiality, integrity and availability impact, with scope unchanged.
  • The exact impact on Azure Front Door tenants is not detailed in the available record.

Affected products and versions

  • Product listed: Microsoft Azure Front Door.
  • The source does not specify affected versions. Azure Front Door is a managed cloud service, so customers typically do not install a patch themselves; confirm the status of the service in the vendor guidance.

Exploitation status

The CISA KEV catalog does not list this CVE in the data available. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Review the Microsoft Security Update Guide entry for CVE-2026-24300 for the vendor's statement on service remediation and any required customer actions.
  • Inventory Azure Front Door profiles and related access configurations so that administrators can verify their exposure quickly.
  • Apply the principle of least privilege to administrative roles that manage Front Door resources.

Detection guidance

  • Review Azure activity and audit logs for unexpected changes to Front Door configuration, access rules or role assignments.
  • Monitor for unusual administrative operations or access patterns affecting edge routing and access controls.

Limitations of the available information

The record provides no affected version range, no fixed build, no vendor-provided technical details beyond the title, and no exploitation data beyond the KEV status. Conclusions about exposure should be verified against the official Microsoft entry.

Frequently asked questions

What is CVE-2026-24300?

It is a critical elevation of privilege vulnerability in Microsoft Azure Front Door, classified as improper access control (CWE-284).

Is CVE-2026-24300 known to be exploited?

It is not listed in the CISA KEV catalog in the data available, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The record does not specify affected versions. Consult the Microsoft Security Update Guide entry for authoritative details.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.