What is the CVSS score of CVE-2026-47280?

CVE-2026-47280 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Azure Resource Manager are affected by CVE-2026-47280?

Microsoft Azure Resource Manager (ARM)-the central control plane for all Azure resources-contains a critical privilege elevation vulnerability (CVE-2026-47280, CVSS 10.0) allowing unauthenticated…. A patch is available.

How to fix or mitigate CVE-2026-47280?

Within 24 hours: Identify all Azure subscriptions and initiate emergency patching of Azure Resource Manager components through Azure Update Management and partner portals; confirm vendor patch deployment before returning to normal operations. Within 7 days: Audit Azure access logs for anomalous privilege escalation or administrative activity during the exposure window; isolate and analyze any suspicious role assignments or resource access. Within 30 days: Implement additional authentication hardening (MFA enforcement, Conditional Access policies on control-plane operations) and complete a full review of ARM RBAC configuration for lateral movement paths.

Azure Resource Manager CVE-2026-47280

EUVD-2026-31514 CRITICAL

Improper Authentication (CWE-287)

2026-05-22 microsoft

GHSA-q9gj-2hh6-3882

Microsoft Authentication Bypass

10.0

CVSS 3.1 · NVD

Temporal: 8.7

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CIRCL (temporal)

8.7 HIGH

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 22, 2026 - 22:47 vuln.today

DescriptionCVE.org

Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authentication and gain elevated privileges across the cloud control plane. The flaw carries a maximum CVSS score of 10.0 due to a scope change combined with full confidentiality, integrity, and availability impact, and although Microsoft has released a fix there is no public exploit identified at time of analysis. Given ARM is the central management layer for nearly all Azure resources, successful exploitation could have broad tenant-wide consequences.

Technical ContextAI

Azure Resource Manager is Microsoft's deployment and management service that serves as the authentication and authorization control plane for Azure subscriptions, mediating all REST API calls to create, configure, and govern Azure resources (identified by cpe:2.3:a:microsoft:azure_resource_manager). The root cause is classified as CWE-287 (Improper Authentication), meaning the service fails to correctly verify identity claims or token validity before granting privileged operations. Because ARM brokers calls to nearly every Azure service - IAM, Key Vault, storage, compute, networking - a flaw in its authentication path effectively undermines the security boundary of any resource it manages.

RemediationAI

Patch available per vendor advisory: Microsoft has issued a fix as documented in MSRC at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47280, and because ARM is a managed cloud service the remediation is applied server-side by Microsoft with no customer action required for the core fix. Customers should still verify their tenants by reviewing Azure Activity Logs and Microsoft Entra ID sign-in logs for anomalous ARM API calls, role assignments, or resource modifications during the exposure window, and tighten ARM access using Conditional Access policies that restrict management plane operations to trusted networks and devices (trade-off: legitimate admin operations from new locations may be blocked). Additionally, enforce Privileged Identity Management (PIM) just-in-time access and enable Microsoft Defender for Cloud's control-plane threat detections to flag suspicious post-exploitation activity.