Cyber Resilience

CVE-2026-24300

Critical

Published: 05 February 2026

Published
05 February 2026
Modified
12 February 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0125 65.6th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-24300 is a critical-severity Improper Access Control (CWE-284) vulnerability in Microsoft Azure Front Door. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 34.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-24300 is an Elevation of Privilege vulnerability affecting Azure Front Door. It carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-284 (Improper Access Control). The vulnerability was published on 2026-02-05T23:15:54.490.

An unauthenticated attacker with network access can exploit this vulnerability due to its low attack complexity and lack of required user interaction. Successful exploitation enables privilege elevation, leading to high impacts on confidentiality, integrity, and availability of the affected component.

Microsoft's update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24300 provides details on mitigation and patching for this vulnerability.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

Azure Front Door Elevation of Privilege Vulnerability

CWE(s)
CWE-284

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Remote unauthenticated EoP in public-facing Azure Front Door directly enables exploitation of internet-facing apps (T1190) for privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-24306Same product: Microsoft Azure Front Door
CVE-2026-24304Same vendor: Microsoft
CVE-2025-53763Same vendor: Microsoft
CVE-2025-24989Same vendor: Microsoft
CVE-2025-55244Same vendor: Microsoft
CVE-2025-59273Same vendor: Microsoft
CVE-2025-21380Same vendor: Microsoft
CVE-2026-24290Same vendor: Microsoft
CVE-2025-24076Same vendor: Microsoft
CVE-2025-21359Same vendor: Microsoft

Affected Assets

microsoft
azure front door
all versions

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

Directly enforces approved access control policies to prevent unauthorized privilege elevation due to improper access control (CWE-284) in Azure Front Door.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and correction of flaws like this high-severity elevation of privilege vulnerability via patching as recommended by Microsoft.

AC-6 Least Privilege partial match
prevent

Enforces least privilege to limit the impact and scope of any successful privilege escalation from unauthenticated network access.

References