What is the CVSS score of CVE-2026-23651?

CVE-2026-23651 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Aci Confidential Containers are affected by CVE-2026-23651?

Organizations using Permissive regular expression in Azure Compute Gallery should be aware of notable risk from CVE-2026-23651 rated CVSS 6.7.. A patch is available.

How to fix or mitigate CVE-2026-23651?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Aci Confidential Containers CVE-2026-23651

MEDIUM

Permissive Regular Expression (CWE-625)

2026-03-05 secure@microsoft.com

Information Disclosure Microsoft Aci Confidential Containers

6.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.7 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 23:16 nvd

MEDIUM 6.7

DescriptionCVE.org

Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.

AnalysisAI

Privilege escalation in Azure Compute Gallery's regex validation enables high-privileged local users to gain unauthorized system access on affected Microsoft and ACI Confidential Containers systems. An authenticated attacker with elevated permissions can exploit the permissive pattern matching to bypass security controls and achieve full system compromise. No patch is currently available, making this a medium-severity risk for environments running vulnerable versions.