CVE-2026-42822 is an improper authentication vulnerability (CWE-287) affecting Microsoft Azure Local Disconnected Operations. This flaw allows an attacker without prior privileges to elevate their privileges remotely over a network. The vulnerability is rated critical with a CVSS 3.1 base score of 10.0, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and complete impact on confidentiality, integrity, and availability. Microsoft has released an official fix and manages remediation for this cloud-hosted service. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42822.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to gain elevated privileges within the Azure Local environment, potentially compromising confidentiality, integrity, and availability of affected systems. Given the critical CVSS score, the impact is severe, enabling full control over the targeted service.

Microsoft has released an official fix for this vulnerability and manages remediation for this cloud-hosted service. Users should follow the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42822 to ensure their Azure Local environments are updated. No additional mitigation actions are required beyond applying the official fix.