This vulnerability (CWE-73) in Microsoft Azure Stack Edge involves external control of file name or path, which can be exploited by an attacker over the network to execute arbitrary code without requiring privileges or user interaction. The CVSS 3.1 base score is 9.8, indicating critical severity with network attack vector, low complexity, no privileges required, and no user interaction needed. The vulnerability affects version 2.2.0 of Azure Stack Edge. Microsoft has issued an official fix and manages patching for this cloud-hosted service. The vendor advisory is available at the Microsoft Security Response Center.

Successful exploitation allows an attacker to execute arbitrary code remotely on Azure Stack Edge, leading to complete compromise of confidentiality, integrity, and availability of the affected system. This can result in full control over the service and potentially the underlying infrastructure.

An official fix is available from Microsoft, and as Azure Stack Edge is a cloud service, Microsoft manages the remediation server-side. Users should refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47643 for detailed guidance and ensure their Azure Stack Edge instances are updated accordingly.