CVE-2026-24304CWE-284broken-access-control

CVE-2026-24304

Critical · published January 23, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
51.3
In the wild
Unconfirmed
What it is

🔥 Azure Resource Manager has a sneaky flaw: an attacker with only authorized access can boost their privileges and wield power over your network! Think of it like a security guard who mistakenly gives a VIP badge to a regular visitor — now they can access all the restricted areas! It's a recipe for chaos! This vulnerability could allow an attacker to escalate their privileges, gaining control over critical resources and potentially wreaking havoc across your network. They could alter configurations, access sensitive data, or even disrupt services, leading to devastating consequences for your organization.

Put simply

Think of it like a security guard who mistakenly gives a VIP badge to a regular visitor — now they can access all the restricted areas! It's a recipe for chaos! CVE-2026-24304 is an improper access control vulnerability in Azure Resource Manager that permits an authorized user to elevate their privileges, bypassing restrictions intended to limit access to certain resources.

What to do

This vulnerability could allow an attacker to escalate their privileges, gaining control over critical resources and potentially wreaking havoc across your network. They could alter configurations, access sensitive data, or even disrupt services, leading to devastating consequences for your organization. To protect yourself, immediately review and tighten access controls within your Azure environment. Ensure that least privilege principles are enforced, and consider implementing additional monitoring to detect suspicious activities. Regularly audit user permissions to catch any potential abuse before it escalates. 🔒 You've got this! With proactive measures, you can secure your Azure environment and fortify your defenses! 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00667 · 51.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-01-23T07:15Z
Affected products (1)
ProductVersionsFixed in
microsoft/azure_resource_managerall versions—
References (1)
EPSS history
Timeline
  • 23 JAN 01:18Z
    Azure Resource Manager Elevation of Privilege Vulnerability
    cvelistv5