CVE-2026-58275 is a critical flaw (CVSS 10.0) in Microsoft Azure DNS. Missing authorization lets an unauthorized attacker elevate privileges over a network. The record gives no versions or fix steps, so read the Microsoft update guide to see what action it asks of you.
What's affected
- Microsoft Azure DNS. The record lists no versions.
- Fix: not described in the record. The MSRC guide states whether customers must act.
How to check if you're exposed
Azure DNS is a cloud service run by Microsoft. Open the MSRC page for this CVE and read whether customer action is required. Then review who holds DNS Zone Contributor and similar roles in your subscriptions.
Cloud service CVEs are not something a dependency scan can find, but the Gold directory keeps the CVE record and weakness class in one place for your change ticket.
What to do now
- Read the MSRC guide for CVE-2026-58275.
- Follow any customer steps it lists.
- Review role assignments on DNS zones and remove access that is not needed.
- Check activity logs for unexpected record changes.
Write down what you checked and when. For a managed service the record is part of how you show later that you read the advisory, decided whether it applied, and acted on the result.
Why it matters
The class is CWE-862 (Missing Authorization). An operation runs without checking whether the caller may perform it. The vector reads as network reachable, no login, scope changed, with integrity and availability high. DNS changes can redirect traffic, which explains the top score.
The CISA KEV flag is false. The MSRC page could not be read as plain text, so this post does not describe the mechanism.
Because the record carries a perfect score and almost no text, the most useful thing you can do is read the vendor guide, write down the conclusion, and move on to the review of who can change DNS in your subscriptions. That review is worth doing whatever the guide says.
Quick check
Do I need to patch anything?
For a managed cloud service the fix is usually applied by the provider. Confirm that in the MSRC guide.
Sources
Last reviewed: 19 October 2026.
