An attacker who has already been granted access to Azure Privileged Identity Management can exploit a flaw that allows the manipulation of a user-controlled key to bypass authorization checks. This leads to elevation of privileges within the service, breaking the isolation between normal and privileged roles. The weakness, identified as CWE‑639, directly undermines access controls and can result in untrusted users gaining administrative authority over Azure resources.

Microsoft Azure Privileged Identity Management (PIM) is the affected product, as listed by the CNA. The vulnerability applies to all current versions of the service until an official fix is released; specific version numbers are not provided in the available data.

The CVSS score of 8.8 indicates a high severity risk. Since EPSS data is not available, the likelihood of exploitation cannot be estimated from that metric, and the vulnerability is not currently listed in the CISA KEV catalog. The attack vector is likely network-based, requiring an authorized account within Azure PIM; an attacker can manipulate the key over the network to achieve elevation. The impact is elevated privileges across Azure resources managed through PIM.