Azure Arc EUVD-2026-63621

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required beyond network reachability of the affected Azure service endpoint - remote, unauthenticated exploitation with low complexity and no user interaction. The principal limiting factor is the affected-surface ambiguity: the description names Azure Arc while the CPE names Azure Web Apps, so exploitability in practice depends on which component is actually exposed and whether Microsoft has already remediated it service-side. Exploitation targets the name/reference-resolution logic (CWE-706) of the cloud control plane; deployments not exposing the affected management endpoint to the attacker's network path are correspondingly less reachable.

This carries the maximum CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H): network-reachable, low complexity, no privileges, no user interaction, scope change, and full confidentiality/integrity/availability impact - the profile of a critical, trivially triggerable, unauthenticated privilege escalation in a cloud control plane, which any operator should treat as urgent. Tempering that raw score: there is no public exploit identified at time of analysis, the CVE is not in CISA KEV, and no EPSS score was provided, so there is no evidence of active or widespread exploitation yet - the priority is driven by severity and cloud blast-radius, not by observed attacks. A further caveat is the affected-product conflict (description says Azure Arc, CPE/tags say Azure Web Apps); if this is a Microsoft-operated cloud service, Microsoft likely remediates it service-side, sharply reducing customer action, whereas if any customer-managed Arc agent/connector component is involved, customers must patch. This ambiguity should be resolved against the MSRC advisory before finalizing internal risk ratings.

A remote attacker with no credentials sends crafted requests to the exposed Azure Arc/App Service management surface that cause a resource or identity reference to resolve to an entity under the attacker's control, binding their request to a higher-privilege scope. Leveraging the scope change, the attacker gains elevated privileges over resources outside the originally-reachable boundary, enabling full read/write and disruption. No public proof-of-concept is identified at time of analysis.