This vulnerability, tracked as CVE-2026-40412 and classified under CWE-434 (Unrestricted Upload of File with Dangerous Type), affects Microsoft Azure Orbital Spatio, a cloud service. It permits an attacker with no privileges and no user interaction to upload malicious files that can lead to remote code execution, compromising confidentiality, integrity, and availability. The vulnerability is rated critical with a CVSS 3.1 base score of 10.0. Microsoft has released an official fix and manages remediation for this cloud-hosted service.

Successful exploitation allows an unauthenticated attacker to execute arbitrary code remotely on the affected Azure Orbital Spatio service, leading to full compromise of confidentiality, integrity, and availability of the system. This could result in complete control over the affected environment.

Microsoft has provided an official fix for this vulnerability and manages remediation for Azure Orbital Spatio as a cloud service. Users should ensure their Azure Orbital Spatio instances are updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40412. No additional user action is required beyond applying the official fix.