CVE-2026-24304
Published: 23 January 2026
Summary
CVE-2026-24304 is a critical-severity Improper Access Control (CWE-284) vulnerability in Microsoft Azure Resource Manager. Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 18.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Enforces approved authorizations for logical access to prevent improper access control that enables privilege escalation in Azure Resource Manager.
Applies the principle of least privilege to restrict low-privilege users from escalating privileges over the network as exploited in this CVE.
Manages accounts and associated privileges to identify and remediate over-privileging that could be exploited for elevation in Azure Resource Manager.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE enables remote privilege escalation via improper access control in a publicly exposed cloud management service (Azure Resource Manager).
NVD Description
Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network.
Deeper analysisAI
CVE-2026-24304, published on 2026-01-23, is an improper access control vulnerability (CWE-284) affecting Azure Resource Manager. The issue enables an authorized attacker to elevate privileges over a network and carries a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and high impacts across confidentiality, integrity, and availability with a changed scope.
An attacker requires only low privileges (PR:L) to exploit the vulnerability remotely over the network (AV:N) without user interaction (UI:N) or high complexity (AC:L). Successful exploitation allows privilege escalation, resulting in high impacts on confidentiality, integrity, and availability while changing the scope (S:C) to affect additional resources.
Mitigation guidance is available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24304.
Details
- CWE(s)