Improper certificate validation in Azure Local enables an unauthorized attacker to execute arbitrary code over the network. This flaw permits remote code execution by accepting invalid or forged certificates, thereby compromising confidentiality, integrity, and availability of the affected service.

The vendor and product impacted are Microsoft Azure Local. No specific version information is listed in the available data, so all deployments of Azure Local that may not have applied the latest security updates are potentially vulnerable.

The CVSS score of 8.1 reflects high severity, yet the EPSS score of less than 1% indicates a low likelihood of exploitation at present. The vulnerability is not yet listed in the CISA KEV catalog. Attackers would need network access to the Azure Local service and could exploit the weakness by presenting a malformed or self‑signed certificate during TLS negotiation. Because the fault lies in certificate validation, the exposure is generally limited to systems that rely on Azure Local for network communication, but the impact of successful exploitation would be full remote code execution.