CVE-2026-42822 is an improper authentication vulnerability (CWE-287) in Microsoft Azure Local Disconnected Operations that permits an attacker without prior privileges to elevate their privileges over a network. The vulnerability has a CVSS 3.1 base score of 10.0, indicating critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The affected product is Azure Local version 1.0.0. Microsoft has released an official fix and manages remediation for this cloud-hosted service. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42822.

An attacker can exploit this vulnerability remotely without authentication or user interaction to gain elevated privileges, resulting in full compromise of the affected system's confidentiality, integrity, and availability. This could allow unauthorized access to sensitive data, modification of system configurations, and disruption of service.

Microsoft has released an official fix for this vulnerability and manages remediation for the Azure Local cloud service. Users should ensure their Azure Local environment is updated according to Microsoft's guidance in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42822. No additional mitigation actions are required beyond applying the official fix.