EUVD-2026-48602
GHSA-wv23-fpx3-g972
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable managed service with an unauthenticated access-control bypass (PR:N/UI:N/AC:L) yielding total impact matches SSVC 'total', supporting C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft Azure App Service for Linux lets a remote, unauthenticated attacker bypass access controls and gain elevated privileges over the network, per Microsoft's MSRC advisory and a CVSS 9.8 rating. Because the underlying weakness is improper access control (CWE-284), a successful attack yields total confidentiality, integrity, and availability impact on the affected app-hosting environment. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though CISA's SSVC assessment flags the flaw as automatable with total technical impact, and the modest EPSS score (0.81%) reflects an as-yet-unproven-but-realistic exploitation path.
Technical ContextAI
Azure App Service is Microsoft's managed PaaS for hosting web apps, APIs, and functions; the affected surface here is specifically the Linux variant (CPE cpe:2.3:a:microsoft:azure_app_service_for_linux). The root cause is CWE-284 (Improper Access Control) - an authorization/authentication-bypass class of defect where the platform fails to correctly enforce who may perform a privileged action. In a multi-tenant PaaS such as App Service, access-control gaps are particularly consequential because they can let a caller cross an authorization boundary (e.g., act with rights beyond their assigned role) without needing a memory-corruption or code-injection primitive. The tags 'Authentication Bypass' and 'Azure App Service For Linux' reinforce that the flaw is an identity/authorization enforcement failure rather than a parsing or code-execution bug.
RemediationAI
Patch available per vendor advisory: Microsoft has released a fix for CVE-2026-58630, documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58630. Because Azure App Service is a Microsoft-managed PaaS, the platform-level remediation is applied by Microsoft rather than by customers installing a numbered release, so no exact customer-installable fix version is provided in the source data; operators should confirm via the MSRC Update Guide that their App Service for Linux plans are running on the remediated platform build and review the advisory for any customer action items. As interim risk reduction while confirming remediation, restrict network exposure of hosted apps using Access Restrictions/IP allowlists and Private Endpoints or VNet integration to limit who can reach the service, enforce strong authentication (Microsoft Entra ID / App Service Authentication) and least-privilege managed identities and RBAC roles, and monitor App Service and Azure activity logs for anomalous privileged actions - noting that network restrictions may break legitimate public access and should be scoped to known clients.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today