CVE-2026-24302: Microsoft Azure Arc: improper access control (CWE-284)
CVE-2026-24302 is an improper access control weakness in Microsoft Azure Arc that, according to the record, lets an unauthorized attacker over the network elevate privileges. NVD rates it critical with a CVSS 3.1 base score of 9.8, while the CNA score in the record is 8.6. The sources consulted show no confirmed exploitation, and the record does not list affected or fixed versions.
Overview
CVE-2026-24302 is an improper access control weakness (CWE-284) in Microsoft Azure Arc. According to the record, an unauthorized attacker with network access could elevate privileges.
Impact
- Confirmed: the description states that an unauthorized attacker can elevate privileges over a network.
- NVD assigns a CVSS 3.1 base score of 9.8 (critical), with network attack vector, low complexity, no privileges or user interaction required, and high impact to confidentiality, integrity and availability.
- The CNA score in the record is 8.6 (CVSS 3.1), so the two providers score it differently.
Affected products and versions
- Product: Microsoft Azure Arc.
- Versions: not specified by the source. Consult the vendor advisory for the affected build list.
Exploitation status
The CISA KEV catalog does not list this CVE according to the record, and no confirmed exploitation appears in the sources consulted. No EPSS data is available.
Remediation and mitigation
- Review the Microsoft Security Response Center update guide entry and apply the vendor-provided update for Azure Arc.
- The record contains no fixed version. Treat this as unknown, not as proof that no fix exists.
- Limit network exposure of Azure Arc-related management components to trusted segments until patched.
- Review privileges granted to Azure Arc-related identities and apply least privilege.
Detection guidance
- Monitor Azure activity logs for unexpected role assignments, permission changes or access by unfamiliar identities.
- Review network telemetry for unusual access to Azure Arc components from untrusted sources.
Limitations of the available information
The record lacks affected version ranges, fixed versions, EPSS data, SSVC data and technical details beyond the short description. This analysis relies on the English description, the NVD and CNA scores, and the MSRC reference.
Frequently asked questions
What is CVE-2026-24302?
It is an improper access control weakness (CWE-284) in Microsoft Azure Arc that, according to the record, allows an unauthorized attacker to elevate privileges over a network.
How severe is it?
NVD scores it 9.8 under CVSS 3.1 (critical). The CNA score in the record is 8.6, so providers differ.
Is it being exploited?
The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
Which versions are affected?
The source does not specify affected versions. Check the Microsoft update guide entry for details.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.