What is the CVSS score of EUVD-2026-48460?

EUVD-2026-48460 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Azure DNS are affected by EUVD-2026-48460?

A critical authorization flaw in Microsoft Azure DNS exposes organizations to unauthenticated remote attackers who can seize control of DNS records; no public exploit identified at time of analysis.. A patch is available.

How to fix or mitigate EUVD-2026-48460?

Within 24 hours, identify all Azure DNS zones in production and flag any that host authentication systems, email services, or payment processing endpoints for priority remediation. Within 7 days, apply Microsoft's vendor patch to all affected Azure DNS instances per the official advisory; coordinate with infrastructure teams to sequence updates during low-traffic windows to minimize disruption. Within 30 days, audit DNS transaction logs from the preceding 30 days to detect unauthorized zone changes, query anomalies, or indicators of DNS hijacking that may have occurred prior to patching.

Azure DNS EUVD-2026-48460

| CVE-2026-58275 CRITICAL

Missing Authorization (CWE-862)

2026-07-24 microsoft

GHSA-mrf6-vvvg-7w6c

Authentication Bypass Microsoft Azure Dns

9.8

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

CRITICAL

qualitative

NVD

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Network-facing service with a missing authorization check gives unauthenticated, low-complexity access (AV:N/AC:L/PR:N/UI:N) and privilege elevation yields total C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 07, 2026 - 18:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 07, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

Aug 07, 2026 - 18:22 NVD

10.0 (CRITICAL) 9.8 (CRITICAL)

Analysis Generated

Jul 24, 2026 - 00:49 vuln.today

CVE Published

Jul 24, 2026 - 00:01 cve.org

CRITICAL 10.0

DescriptionNVD

Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation in Microsoft Azure DNS lets a remote, unauthenticated attacker bypass authorization checks over the network to gain elevated permissions within the DNS service. The flaw stems from a missing authorization check (CWE-862) and carries a critical CVSS 9.8 with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and EPSS estimates a modest 0.67% 30-day exploitation probability, but CISA's SSVC framework flags the issue as automatable with total technical impact.

Technical ContextAI

Azure DNS is Microsoft's managed, cloud-hosted authoritative DNS service used to host and resolve domain records for Azure-connected workloads, with control-plane operations exposed through Azure Resource Manager APIs and the Azure portal. The root cause is CWE-862 (Missing Authorization): a service operation performs a sensitive action without verifying that the caller holds the required permission, so an actor can invoke functionality reserved for privileged roles. Because Azure DNS is a multi-tenant SaaS control plane reached over the network (CPE cpe:2.3:a:microsoft:azure_dns), the missing check is exploitable through standard service endpoints rather than requiring any local foothold.

RemediationAI

Patch available per vendor advisory - Microsoft has remediated Azure DNS at the service level, so no exact customer-installable fix version applies; the correction is applied centrally to the cloud service. Review the Microsoft MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58275 to confirm the fix status for your tenant and whether any customer action is required. As defense-in-depth for the DNS control plane, enforce least-privilege Azure RBAC on DNS zone resources (restrict the DNS Zone Contributor role), enable Azure Activity Log and resource logging on DNS zones to detect unexpected record or permission changes, and use Azure Policy plus resource locks to limit who can modify zone configurations - the trade-off being added administrative overhead and potential friction for legitimate automation. Monitor for anomalous record modifications as a compensating detection control since the underlying authorization gap was server-side.