This vulnerability (CVE-2026-35430) involves an authorization bypass in Azure Privileged Identity Management (PIM) due to improper handling of a user-controlled key, categorized under CWE-639. An attacker with some level of authorization can exploit this flaw to elevate privileges remotely. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. Microsoft has issued an official fix and manages patching for this cloud-hosted service. The vendor advisory is available at the Microsoft Security Response Center.

Successful exploitation allows an authorized attacker to bypass authorization mechanisms and escalate privileges within Azure PIM, potentially gaining unauthorized administrative capabilities. This can lead to full compromise of sensitive identity and access management functions, affecting confidentiality, integrity, and availability of the environment.

Microsoft has released an official fix for this vulnerability and manages remediation for Azure PIM as a cloud service. Customers should ensure their Azure PIM service is updated according to Microsoft's guidance available in the vendor advisory. No additional action is required beyond applying the official fix as managed by Microsoft.