Skip to main content

Azure CVE-2026-24306

CRITICAL
Improper Access Control (CWE-284)
2026-01-22 secure@microsoft.com
Azure Azure Front Door
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 22, 2026 - 23:15 nvd
CRITICAL 9.8

DescriptionCVE.org

Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Azure Front Door has an improper access control vulnerability (CVSS 9.8) allowing unauthorized attackers to elevate privileges through the CDN and WAF infrastructure.

Technical ContextAI

Azure Front Door (AFD) has a CWE-284 improper access control vulnerability that allows unauthorized network-based attackers to elevate privileges, potentially bypassing WAF rules or accessing origin servers directly.

RemediationAI

Apply Microsoft patches. Implement origin server IP whitelisting independent of Azure Front Door.

More in Azure

View all
CVE-2026-23889 MEDIUM POC
6.5 Jan 26

Path traversal in pnpm's tarball extraction on Windows allows attackers to write files outside the intended package dire
CVE-2026-31957 CRITICAL
10.0 Mar 11

Default password in Himmelblau Azure Entra ID suite 3.0.0-3.0.x. CVSS 10.0.
CVE-2025-20286 CRITICAL
9.9 Jun 04

Default credentials in Cisco ISE cloud deployments on AWS/Azure/OCI. CVSS 9.9.
CVE-2026-21531 CRITICAL
9.8 Feb 10

Deserialization of untrusted data in Azure SDK allows unauthorized code execution over a network. EPSS 0.32%.
CVE-2026-24300 CRITICAL
9.8 Feb 05

Elevation of privilege vulnerability in Azure Front Door allows attackers to gain elevated access. Microsoft Azure cloud
CVE-2026-3224 CRITICAL
9.8 Mar 03

Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier.
CVE-2026-23518 CRITICAL
9.8 Jan 21

Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware
CVE-2026-24305 CRITICAL
9.3 Jan 22

Azure Entra ID (formerly Azure AD) has an elevation of privilege vulnerability allowing attackers to escalate permission
CVE-2026-21227 HIGH
8.2 Jan 22

Privilege escalation in Azure Logic Apps results from improper path validation, enabling remote attackers to gain elevat
CVE-2026-21532 HIGH
8.2 Feb 05

Azure Function Information Disclosure Vulnerability [CVSS 8.2 HIGH]
CVE-2026-21228 HIGH
8.1 Feb 10

Remote code execution in Azure Local stems from improper certificate validation, enabling unauthenticated attackers to e
CVE-2026-21224 HIGH
7.8 Jan 13

Local privilege escalation in Azure Connected Machine Agent exploits a stack-based buffer overflow, enabling authenticat

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Share

CVE-2026-24306 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy