CVE-2026-24300
Published: 05 February 2026
Summary
CVE-2026-24300 is a critical-severity Improper Access Control (CWE-284) vulnerability in Microsoft Azure Front Door. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 21.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly enforces approved access control policies to prevent unauthorized privilege elevation due to improper access control (CWE-284) in Azure Front Door.
Requires timely identification, reporting, and correction of flaws like this high-severity elevation of privilege vulnerability via patching as recommended by Microsoft.
Enforces least privilege to limit the impact and scope of any successful privilege escalation from unauthenticated network access.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated EoP in public-facing Azure Front Door directly enables exploitation of internet-facing apps (T1190) for privilege escalation (T1068).
NVD Description
Azure Front Door Elevation of Privilege Vulnerability
Deeper analysisAI
CVE-2026-24300 is an Elevation of Privilege vulnerability affecting Azure Front Door. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-284 (Improper Access Control). The vulnerability was published on 2026-02-05T23:15:54.490.
An unauthenticated attacker with network access can exploit this vulnerability due to its low attack complexity and lack of required user interaction. Successful exploitation enables privilege elevation, leading to high impacts on confidentiality, integrity, and availability of the affected component.
Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24300 provides details on mitigation and patching for this vulnerability.
Details
- CWE(s)