CVE-2026-24304 is a critical severity (CVSS 9.9) elevation of privilege vulnerability in Azure Resource Manager. Microsoft's update guide data marks customer action as not required. Confirm that in the guide, review access to the service, and check your own audit logs.
What's affected
Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network. The CVSS base score is 9.9.
Microsoft's update guide data for this CVE reports it as not publicly disclosed and not exploited at the time of the latest revision (30 July 2026), and it flags no customer action as required. The affected component is a cloud service that Microsoft operates, so there is no version number for you to patch. The attacker needs low privileges, meaning an ordinary authenticated account.
How to check if you're exposed
There is nothing to scan for in your own code. Use the update guide entry as your record, and read it again for revisions:
curl -s https://api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/CVE-2026-24304
The response includes the release date, the latest revision date and the customer action flag. Beyond that, review who holds roles and service principals in the affected service, and read your audit logs for anything unexpected around the disclosure date.
What to do now
- Open Microsoft's update guide entry for CVE-2026-24304 and confirm the customer action field.
- Note the latest revision date, and check again if it changes.
- Review role assignments and service principals in your tenant, and remove access nobody needs.
- Check audit logs for unexpected privilege changes and keep them for your records.
Why it matters
The weakness is CWE-284, improper access control. A service decides what a caller may do, and the check can be missing, wrong or skippable. The CVSS scope is changed, which means the impact can reach beyond the vulnerable component into other resources.
When a cloud provider fixes a flaw in its own service, you usually cannot patch anything. What you can do is keep least privilege in place so that a future flaw of this type has less to reach. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Do I need to patch anything?
Microsoft's update guide data marks customer action required as false for this CVE. Confirm that on the guide page.
Is it exploited?
Microsoft's data lists it as not exploited, and it is not in CISA's Known Exploited Vulnerabilities catalog.
Sources
Last reviewed: 19 October 2026.
