This vulnerability (CVE-2026-26124) involves a path traversal issue (CWE-35) in Microsoft ACI Confidential Containers within Azure Compute Gallery. An authorized attacker with high privileges can exploit the '.../...//' path traversal to elevate privileges locally. The vulnerability has been assigned a CVSS 3.1 base score of 6.7 (medium severity) with partial exploit code maturity and confirmed remediation. Microsoft has released an official fix and manages remediation for this cloud-hosted service. No active exploitation has been observed.

An authorized attacker with high privileges can leverage this path traversal vulnerability to elevate their privileges locally, potentially gaining higher access within the affected environment. The confidentiality, integrity, and availability impacts are all rated high according to the CVSS vector, indicating significant potential damage if exploited.

Microsoft has released an official fix for this vulnerability and manages remediation for this cloud-hosted service. Users should ensure their Azure Compute Gallery and Microsoft ACI Confidential Containers environments are updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26124. No additional action is required beyond applying the official fix.