CVE-2026-47280 is a critical security vulnerability classified as CWE-287 (Improper Authentication) in Microsoft Azure Resource Manager. It enables an attacker without prior privileges to elevate their privileges remotely over the network, potentially compromising confidentiality, integrity, and availability of resources managed by ARM. The vulnerability affects the cloud service, and Microsoft has issued an official fix. The CVSS v3.1 score is 10.0, indicating maximum severity. The vendor manages remediation for this cloud-hosted service and provides an advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47280.

Successful exploitation of this vulnerability allows an attacker to bypass authentication controls and gain elevated privileges in Azure Resource Manager, leading to full compromise of affected resources. This impacts confidentiality, integrity, and availability of cloud resources managed via ARM.

Microsoft has released an official fix for this vulnerability and manages remediation for the Azure Resource Manager cloud service. Users should follow the guidance in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47280 to ensure their environments are protected.