This vulnerability (CVE-2026-23651) arises from a permissive regular expression in the Azure Compute Gallery component of Microsoft ACI Confidential Containers. It enables an attacker who already has high privileges and local access to escalate their privileges further on the system. The vulnerability is classified under CWE-625 (Permissive Regular Expression). Microsoft manages remediation for this cloud-hosted service and has released an official fix to address the issue.

An authorized attacker with high privileges can exploit this vulnerability to elevate their privileges locally, potentially gaining greater control over the affected environment. The impact includes high confidentiality, integrity, and availability consequences as indicated by the CVSS vector. However, exploitation requires existing high privileges and local access.

Microsoft has released an official fix for this vulnerability. Since this is a cloud service, Microsoft manages the remediation server-side. Users should ensure their Microsoft ACI Confidential Containers environment is updated according to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23651. No additional user action is required beyond applying the official fix.