What is the CVSS score of CVE-2026-24304?

CVE-2026-24304 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Azure Resource Manager are affected by CVE-2026-24304?

Microsoft Azure Resource Manager privilege escalation (CVE-2026-24304) allows network-based attackers to bypass access controls and gain unauthorized read/write access to Azure resources across…. A patch is available.

How to fix or mitigate CVE-2026-24304?

Within 24 hours: Inventory all Azure subscriptions and verify current Azure Resource Manager patch status using Azure portal or Azure CLI; enable enhanced logging and alerting on ARM API calls and authentication events; brief incident response team on escalation procedures. Within 7 days: Apply the available Microsoft security patch to Azure Resource Manager across all production and non-production subscriptions; perform comprehensive access control audit to identify and remediate overly permissive service principals, managed identities, and role assignments. Within 30 days: Complete forensic review of Azure Resource Manager logs for the past 90 days using Azure Sentinel or Security Center to detect unauthorized resource modifications or cross-subscription access; validate successful patch deployment across 100% of environments; establish recurring access reviews and implement conditional access policies restricting ARM operations to known, trusted locations and identities.

Azure Resource Manager CVE-2026-24304

CRITICAL

Improper Access Control (CWE-284)

2026-01-23 secure@microsoft.com

Authentication Bypass Microsoft Azure Resource Manager

9.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Description's 'authorized attacker' implies a valid low-privileged identity is required, so PR:L rather than PR:N; network vector, low complexity, and cross-boundary escalation justify S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Jul 30, 2026 - 21:37 NVD

10.0 (CRITICAL) 9.9 (CRITICAL)

Analysis Updated

Jul 30, 2026 - 20:43 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 30, 2026 - 20:37 vuln.today

cvss_changed

CVSS changed

Jul 30, 2026 - 20:37 NVD

9.9 (CRITICAL) 10.0 (CRITICAL)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 23, 2026 - 02:15 nvd

CRITICAL 9.9

DescriptionNVD

Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Azure Resource Manager (ARM) lets a network-based attacker abuse an improper access control flaw (CWE-284) to elevate privileges and gain full read/write/impact control over resources beyond their intended authorization boundary, with a scope-changing blast radius (S:C) rated CVSS 10.0. Because ARM is the unified control-plane API that governs deployment and management of virtually all Azure resources, a successful escalation can cross tenant or subscription trust boundaries. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.05%), indicating no observed weaponization despite the maximal CVSS.

Technical ContextAI

Azure Resource Manager is the management-plane control layer for Microsoft Azure - every create/read/update/delete operation on Azure resources (VMs, storage, RBAC role assignments, networking) is brokered through the ARM REST API and its RBAC authorization engine. The root cause is classified as CWE-284 (Improper Access Control): an authorization check is missing, misapplied, or bypassable, allowing an actor to perform operations they should not be entitled to. The single affected CPE is cpe:2.3:a:microsoft:azure_resource_manager (version '-', reflecting a continuously-serviced cloud service rather than a shippable versioned product), meaning the fix is delivered server-side by Microsoft rather than as a customer-installed update. The scope change (S:C) in the CVSS vector implies the vulnerable authorization component and the impacted resources sit in different security authorities - consistent with an escalation that crosses an RBAC or tenant boundary.

RemediationAI

Patch available per vendor advisory - because Azure Resource Manager is a Microsoft-operated cloud service, the fix is deployed server-side by Microsoft and generally requires no customer action; consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24304 to confirm mitigation status for your tenant. As defense-in-depth while validating, tighten Azure RBAC by removing standing broad-scope role assignments (e.g., Owner/Contributor at subscription or management-group scope) and enforcing least privilege, enable Privileged Identity Management (PIM) for just-in-time elevation, and require Conditional Access with MFA for management-plane operations; the trade-off is added operational friction for administrators and automation service principals. Review Azure Activity Logs and Microsoft Entra sign-in/audit logs for anomalous role assignments or cross-scope resource operations to detect any attempted abuse. Do not rely on an installable version number - none is published for this service.