This vulnerability (CVE-2026-69865) in Microsoft Azure Container Registry allows an unauthorized attacker to bypass authorization controls by manipulating a user-controlled key. This flaw enables privilege escalation over the network, potentially compromising sensitive data and system integrity. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). Microsoft has published an official fix and manages remediation for this cloud-hosted service.

Successful exploitation results in unauthorized privilege escalation, leading to complete compromise of confidentiality and integrity of the Azure Container Registry environment. Availability is not impacted. The vulnerability is remotely exploitable without authentication and requires no user interaction.

Microsoft has released an official fix for this vulnerability. As this is a cloud service, Microsoft manages the remediation on their side. Users should verify that their Azure Container Registry instances are updated per Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69865. No additional user action is required beyond applying the official fix.