What is the CVSS score of CVE-2026-47280?

CVE-2026-47280 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Azure Resource Manager are affected by CVE-2026-47280?

Microsoft Azure Resource Manager (ARM), the unified control plane managing all Azure resources, contains a critical authentication-bypass flaw (CVE-2026-47280, CVSS 9.8) allowing unauthenticated…. A patch is available.

How to fix or mitigate CVE-2026-47280?

Within 24 hours, inventory all Azure subscriptions and determine which are running unpatched ARM versions through Azure Portal or PowerShell compliance queries. Within 7 days, deploy the Microsoft MSRC patch for CVE-2026-47280 to all subscriptions prioritizing production workloads; confirm deployment through update history logs and Azure security compliance tools. Within 30 days, perform a control-plane audit of privileged account activity and resource modifications during the unpatched exposure window, and establish automated patch-compliance monitoring across all subscriptions.

Azure Resource Manager CVE-2026-47280

EUVD-2026-31514 CRITICAL

Improper Authentication (CWE-287)

2026-05-22 microsoft

GHSA-q9gj-2hh6-3882

Authentication Bypass Microsoft Azure Resource Manager

9.8

CVSS 3.1 · NVD

Temporal: 8.7

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CIRCL (temporal)

8.7 HIGH

cvss

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 11:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 11:22 vuln.today

cvss_changed

CVSS changed

Jul 23, 2026 - 11:22 NVD

10.0 (CRITICAL) 9.8 (CRITICAL)

Analysis Generated

May 22, 2026 - 22:47 vuln.today

DescriptionNVD

Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Azure Resource Manager (ARM) allows a remote, unauthenticated attacker to bypass authentication controls and elevate privileges across the Azure control plane. Microsoft self-reported the flaw (CWE-287) and has released a fix through the MSRC update guide; there is no public exploit identified at time of analysis, and EPSS estimates near-term exploitation likelihood at just 0.07%. Because ARM is the unified management layer for virtually all Azure resources, successful abuse could grant broad control-plane authority despite the currently low observed exploitation activity.