CVE-2026-47280 is an improper authentication vulnerability (CWE-287) in Microsoft Azure Resource Manager that enables an attacker without prior privileges to elevate their access rights remotely. The vulnerability affects the cloud-hosted ARM service and has a critical CVSS 3.1 base score of 10.0, reflecting network attack vector, no required privileges or user interaction, and complete impact on confidentiality, integrity, and availability. Microsoft has released an official fix for this vulnerability, and as a cloud service, remediation is managed by Microsoft. No active exploitation has been reported.

Successful exploitation of this vulnerability allows an unauthorized attacker to gain elevated privileges within Azure Resource Manager, potentially leading to full compromise of cloud resources managed by ARM. This impacts confidentiality, integrity, and availability of affected assets. Given the critical CVSS score and the nature of the vulnerability, the impact is severe.

Microsoft has released an official fix for this vulnerability and manages remediation for this cloud-hosted service. Users should ensure their Azure Resource Manager instances are updated according to Microsoft's guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47280. No additional mitigation actions are required beyond applying the official fix.