This vulnerability arises from improper access control in Microsoft Azure Resource Manager, enabling an attacker who already possesses authorized authentication to elevate their privileges over the network. The flaw effectively allows a user with limited rights to acquire higher-level permissions, potentially granting arbitrary configuration changes, data exfiltration, or denial‑of‑service conditions. The CVSS score of 9.9 indicates catastrophic risk to confidentiality, integrity, and availability if exploited.

Microsoft Azure Resource Manager is the affected product. No specific version information is provided in the CNA data; therefore all deployments of Azure Resource Manager that have not applied the latest security updates may be susceptible.

With a CVSS score of 9.9 and an EPSS score below 1%, the likelihood of public exploitation appears low, and the vulnerability is not listed in CISA’s KEV catalog. However, the attack vector is inferred to be a network‑based attack originating from an authenticated account with legitimate access to the ARM API. An attacker would need to abuse the misconfigured permission enforcement to transition from a lower privilege role to a higher one, thereby gaining full control over Azure resources. The danger lies in the potential for broad platform compromise once privileged elevation is achieved.