This vulnerability, identified as CVE-2026-42822 and classified under CWE-287 (Improper Authentication), affects Microsoft Azure Local Disconnected Operations. It enables an attacker without prior privileges to elevate their privileges remotely over a network. The CVSS 3.1 base score is 10.0, indicating critical severity with network attack vector, low attack complexity, no privileges or user interaction required, and complete confidentiality, integrity, and availability impact. The vulnerability is in a cloud service, and Microsoft manages remediation by deploying an official fix.

An attacker can exploit this vulnerability to gain elevated privileges on Azure Local Disconnected Operations remotely without authentication, potentially leading to full compromise of confidentiality, integrity, and availability of the affected service.

Microsoft has released an official fix for this vulnerability. As this is a cloud-hosted service, Microsoft manages the remediation server-side. Users should verify that their Azure Local environment is updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42822. No additional user action is required beyond ensuring the service is up to date.