CVE-2026-24302 is an improper access control vulnerability (CWE-284) in Microsoft Azure ARC that enables unauthorized attackers to elevate privileges remotely over a network. The vulnerability is rated high severity with a CVSS 3.1 score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating network attack vector, low attack complexity, no privileges or user interaction required, and a scope change with high confidentiality impact. Microsoft has released an official fix and manages remediation for this cloud service. No known exploits have been reported.

Successful exploitation allows an attacker to elevate privileges remotely within Azure ARC, leading to a complete confidentiality breach. Integrity and availability are not impacted according to the CVSS vector. The vulnerability affects the cloud-hosted Azure ARC service, potentially impacting all users until remediated.

Microsoft has released an official fix for this vulnerability and manages remediation for Azure ARC as a cloud service. Users should ensure their Azure ARC instances are updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24302. No additional user action is required beyond applying the official fix.