This vulnerability, identified as CWE-706, involves the use of incorrectly-resolved names or references within Azure Arc, a component of Microsoft Azure Web Apps. Exploitation enables an attacker without prior privileges to escalate their privileges across the network, affecting confidentiality, integrity, and availability of the service. The vulnerability is rated critical with a CVSS 3.1 base score of 10.0, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

An unauthorized attacker can elevate privileges over the network, resulting in complete compromise of confidentiality, integrity, and availability of the affected Azure Web Apps environment. This can lead to full control over the service and potentially impact dependent workloads and data.

Microsoft has released an official fix for this vulnerability. As this is a cloud-hosted service, Microsoft manages the remediation server-side. Users should verify that their Azure Web Apps environments are updated according to Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65816 to ensure protection.