An improper authentication vulnerability in Azure Resource Manager (ARM), tracked as CVE-2026-47280, allows an unauthorised attacker to elevate privileges over a network. The vulnerability carries a CVSS score of 10.0 — the maximum possible severity — and affects Azure’s core management and deployment platform. Microsoft has released a security update.
What Is the Vulnerability?
CVE-2026-47280 is an authentication bypass vulnerability in Azure Resource Manager — the deployment and management service that serves as the control plane for all Azure resources. ARM processes every request to create, update, delete, or manage Azure resources across every Azure service. An improper authentication flaw in this layer means an attacker can bypass authentication and elevate privileges, potentially gaining unauthorised management access to Azure resources.
With a CVSS 10.0 — the highest possible score — the vulnerability has the most severe combination: network-exploitable, low attack complexity, no privileges required, no user interaction, and high impact across all three dimensions (confidentiality, integrity, availability). The scope is changed, meaning the vulnerable component can impact resources beyond its own security scope.
- CVSS v3.1 Score: 10.0 (Critical) — maximum severity
- CWE: CWE-287 (Improper Authentication)
- Attack Vector: Network — no authentication required
Which Versions Are Affected?
- Azure Resource Manager — Microsoft has applied the fix to the Azure platform
Is It Being Exploited in the Wild?
No active exploitation has been publicly confirmed. However, a CVSS 10.0 on Azure’s management plane — the control layer for every Azure resource in every subscription — is among the most impactful vulnerability classifications possible in cloud security. Microsoft published the advisory on May 22, 2026.
What Is the Fix?
As an Azure platform service, Microsoft has applied the fix to ARM. Verify with Azure support that the fix is active for your subscriptions. Advisory: MSRC — CVE-2026-47280
Recommendations
Verify ARM fix status. Confirm with Azure support that the CVE-2026-47280 fix has been deployed to the ARM endpoints serving your subscriptions.
Audit Azure Activity Logs. Review the Azure Activity Log for management operations performed by unexpected principals, unusual role assignments, or resource modifications during the vulnerable period (prior to May 22, 2026).
Review Azure RBAC assignments. Check for unexpected role assignments — particularly Owner, Contributor, or User Access Administrator roles granted to unfamiliar service principals or external accounts.
References
- Microsoft MSRC — CVE-2026-47280
- NVD: CVE-2026-47280
- Vulnerability Intelligence Report — June 5, 2026
This advisory is covered in the broader Vulnerability Intelligence Report — June 5, 2026.
