CVE-2026-24302 describes an improper access control vulnerability (CWE-284) in Microsoft Azure ARC that enables an attacker without privileges to elevate their access over a network. The vulnerability has a CVSS 3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and high confidentiality impact. The vulnerability is officially published and a patch is available, though no specific patch links or affected versions are provided. No known exploitation has been reported.

Successful exploitation of this vulnerability could allow an unauthorized attacker to elevate privileges within the Azure ARC environment, potentially leading to unauthorized access to sensitive data or administrative functions. The confidentiality impact is high, but integrity and availability impacts are not indicated. No known exploits are currently active in the wild.

A patch is available for this vulnerability and should be applied promptly to remediate the improper access control issue. Since Azure ARC is not a cloud service in this context, organizations must deploy the patch themselves. No additional vendor advisory details are provided, so check Microsoft’s official security updates for the specific patch and deployment instructions.