This vulnerability (CVE-2026-23651) in Microsoft ACI Confidential Containers arises from a permissive regular expression used in the Azure Compute Gallery component. An attacker who is already authorized and has high privileges can exploit this flaw to elevate their privileges locally, potentially gaining greater control over the affected system. The CVSS vector indicates low attack complexity, no user interaction required, and significant impact on confidentiality, integrity, and availability. The vulnerability is classified under CWE-625 (Permissive Regular Expression).

Successful exploitation allows an authorized user with high privileges to elevate their privileges locally, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

A patch is available for this vulnerability. It is recommended to apply the official fix provided by Microsoft to remediate the issue. Since this is not a cloud service, remediation depends on applying the patch to affected deployments. No additional vendor advisory details were provided, so check Microsoft's official security updates for the patch.