What is the CVSS score of CVE-2026-24302?

CVE-2026-24302 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by CVE-2026-24302?

Azure Arc environments face a high-severity elevation of privilege vulnerability (CVSS 8.6) that could allow attackers to gain administrative control over hybrid and multi-cloud infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-24302?

Within 24 hours: Identify and inventory all Azure Arc-enabled servers and clusters in your environment; restrict Arc-connected resource access to only essential personnel using Azure RBAC. Within 7 days: Implement network segmentation to limit lateral movement from compromised Arc agents; enable enhanced logging and monitoring on all Arc communication channels; brief leadership on current exposure and mitigation status. Within 30 days: Prepare for rapid deployment of the vendor patch upon availability; conduct a security assessment of Arc-dependent workflows; consider temporary operational alternatives for non-critical Arc resources if risk tolerance is exceeded.