This vulnerability, tracked as CVE-2026-35430 and classified under CWE-639 (Authorization Bypass Through User-Controlled Key), affects Microsoft Azure Privileged Identity Management (PIM). It allows an attacker with some level of authorization to bypass normal authorization controls by manipulating a user-controlled key, resulting in privilege escalation over the network. The CVSS v3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. The vulnerability is in a cloud service, and Microsoft has released an official fix as per their security update guide.

An authorized attacker can bypass authorization controls in Azure PIM, leading to elevated privileges. This can compromise confidentiality, integrity, and availability of resources managed through PIM. The vulnerability affects the cloud service and could allow attackers to perform actions beyond their intended permissions.

Microsoft has released an official fix for this vulnerability in Azure Privileged Identity Management. As this is a cloud-hosted service, Microsoft manages the remediation server-side. Users should verify that their Azure PIM service is updated according to Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35430 to ensure protection.