What is the CVSS score of CVE-2026-57104?

CVE-2026-57104 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Which versions of Azure Storage Explorer are affected by CVE-2026-57104?

Microsoft Azure Storage Explorer users are at risk of unauthorized access to cloud storage accounts through a privilege escalation vulnerability triggered when users interact with malicious content.. A patch is available.

How to fix or mitigate CVE-2026-57104?

Within 24 hours, identify all systems running Azure Storage Explorer and document current versions in use across your environment. Within 7 days, deploy the vendor patch by updating to version 20260730.9 or later across all managed workstations and servers; prioritize endpoints with elevated access to critical storage accounts. Within 30 days, conduct a complete inventory verification to ensure 100% of Azure Storage Explorer installations have been patched, and audit access logs for any suspicious activity during the patching window.

Azure Storage Explorer CVE-2026-57104

EUVD-2026-56590 CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-08-11 secure@microsoft.com

GHSA-cxf2-4x8x-vqf5

XSS Microsoft Azure Storage Explorer

9.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Remote script delivery with low complexity but requiring operator interaction (UI:R); Electron renderer breakout justifies S:C with high C/I/A in the client context.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 13:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 13:22 vuln.today

cvss_changed

Severity Changed

Aug 17, 2026 - 13:22 NVD

HIGH CRITICAL

CVSS changed

Aug 17, 2026 - 13:22 NVD

8.8 (HIGH) 9.6 (CRITICAL)

Analysis Generated

Aug 11, 2026 - 21:18 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 8.8

DescriptionNVD

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation via stored/reflected cross-site scripting in Microsoft Azure Storage Explorer (versions prior to 20260730.9) lets a remote attacker inject script that executes in a victim's session when they view attacker-influenced content, enabling scope-changing takeover of the application context. Rated CVSS 9.6 because the scope change (S:C) lets injected code cross the security boundary of the Electron-based client, though exploitation requires the victim to interact with the malicious content (UI:R). No public exploit has been identified at time of analysis; EPSS is a modest 0.81% (54th percentile).

Technical ContextAI

Azure Storage Explorer is Microsoft's cross-platform desktop client (built on Electron/Chromium) for managing Azure Storage accounts, blobs, files, queues, tables, and Azure Data Lake. The flaw is CWE-79, improper neutralization of input during web page generation, meaning attacker-controlled data - plausibly metadata such as blob/container names, tags, or other storage-object properties rendered by the client's web UI - is emitted into the page without adequate encoding. In an Electron application, script that executes inside the renderer can reach beyond a pure browser sandbox, which aligns with the CVSS scope change (S:C) and the privilege-elevation framing. The single affected product per CPE is cpe:2.3:a:microsoft:azure_storage_explorer.

RemediationAI

Vendor-released patch: upgrade Azure Storage Explorer to version 20260730.9 or later, per the Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57104; this is the primary and recommended fix. Until the update is deployed, reduce exposure by avoiding the rendering of storage objects (containers, blobs, file shares, tags, and metadata) originating from untrusted or shared storage accounts, and restrict use of the tool to storage accounts your team controls - the trade-off is reduced operational convenience when triaging third-party or customer-supplied data. Because exploitation requires the operator to view attacker-influenced content, limiting who uses the client against untrusted accounts and enforcing least-privilege on the Azure credentials the client authenticates with limits blast radius if injection occurs. No independent, code-level workaround is documented, so treat upgrading as the durable control.