Overview
CVE-2026-110063 is an elevation-of-privilege vulnerability in VM Inspector for Azure Virtual Machines. Microsoft classifies it as CWE-59, improper link resolution before file access ("link following"), and says an unauthorized attacker can elevate privileges over a network.
Microsoft published it on October 22, 2026 with a CVSS 3.1 base score of 10.0 (temporal 8.7). The vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: network-reachable, low complexity, no privileges, no user interaction, with changed scope.
Status
| Item | Detail |
|---|---|
| Customer action | None required, per Microsoft |
| Fix | Applied by Microsoft to the cloud service |
| Public exploit or technical details | None reported at time of writing |
Third-party databases disagree on the weakness class (some list CWE-269), and speculative descriptions of symlink or race-condition exploitation are not drawn from Microsoft's advisory. Treat those as unconfirmed.
Recommended Actions
- No patching is needed, but confirm your tenant shows the advisory as resolved in the MSRC Security Update Guide.
- Review Azure Activity Logs and VM extension activity for unexpected inspection or extension operations around the disclosure window.
- Apply least privilege to Azure roles that can install or manage VM extensions.