CVE-2026-24306
Published: 22 January 2026
Summary
CVE-2026-24306 is a critical-severity Improper Access Control (CWE-284) vulnerability in Microsoft Azure Front Door. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 48.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-24306 is an improper access control vulnerability affecting Azure Front Door (AFD), published on 2026-01-22. It stems from CWE-284 and enables an unauthorized attacker to elevate privileges over a network. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical due to its network accessibility, low complexity, and lack of prerequisites for exploitation.
Any unauthorized attacker with network access to the affected Azure Front Door instance can exploit this vulnerability remotely without privileges or user interaction. Successful exploitation allows privilege elevation, potentially leading to high-impact compromise of confidentiality, integrity, and availability of the targeted resources.
Mitigation guidance is available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24306.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-4494
Vulnerability details
Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE describes remote unauthenticated exploitation of a public-facing Azure service (AFD) resulting in privilege escalation, directly matching T1190 (public-facing app exploit) and T1068 (priv-esc via exploitation).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved access authorizations, preventing unauthorized privilege elevation due to improper access control in Azure Front Door.
Applies least privilege to restrict unauthorized attackers from escalating privileges even if initial access is gained.
Monitors and controls network communications at system boundaries, blocking remote unauthorized access to vulnerable Azure Front Door instances.