CVE-2026-110063: CWE-59: Improper Link Resolution Before File Access ('Link Following') in Microsoft VM Inspector for Azure Virtual Machines

The vulnerability CVE-2026-110063 in Microsoft VM Inspector for Azure Virtual Machines is classified as CWE-59: Improper Link Resolution Before File Access ('Link Following'). It allows an unauthorized attacker to elevate privileges remotely over a network by exploiting improper handling of symbolic links or similar link types before accessing files. The CVSS v3.1 base score is 10.0, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. The affected product is a cloud service, and Microsoft manages remediation by applying an official fix.

An attacker can remotely elevate privileges without prior authentication, potentially gaining full control over the affected Azure Virtual Machines monitored by VM Inspector. This can lead to complete compromise of confidentiality, integrity, and availability of the system. The vulnerability affects the cloud service environment, increasing the risk of widespread impact if exploited.

Microsoft has released an official fix for this vulnerability. Since VM Inspector for Azure Virtual Machines is a cloud-hosted service, Microsoft manages the remediation server-side. Users should ensure their Azure environment is updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110063. No additional user action is required beyond applying the official fix.