CVE-2026-47280
An attacker can bypass authentication in Azure Resource Manager and gain elevated privileges on the network. The flaw allows unauthorized users to act with the same rights as legitimate administrators. It is a critical vulnerability that could compromise all resources managed by ARM.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Microsoft Azure Resource Manager (ARM) – all users of the Azure portal and ARM APIs.
Real-world impact
An attacker who exploits this flaw can take full control of Azure resources, modify or delete data, and potentially move laterally within the organization’s cloud environment.
Why this severity
The CVSS score of 10 reflects that the vulnerability is exploitable over the network with no authentication or user interaction required, and it grants complete compromise of confidentiality, integrity, and availability.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- May 22, 2026 · May 22, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 12d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…vendor advisory