Improper authentication in Azure Local Disconnected Operations allows an attacker to obtain elevated privileges, enabling them to perform unauthorized actions over a network. This flaw originates from missing enforcement of authentication checks, allowing access to privileged functions that should be restricted to authenticated users. The consequence is that an attacker who can reach the affected components could gain administrative or higher‑level access, jeopardizing the confidentiality, integrity, and availability of Azure resources.

Microsoft Azure Local and Microsoft Azure Resource Manager services are affected. The vulnerability is documented as impacting the Azure Local Disconnected Operations functionality in both platforms. Version details are not specified in the advisory; the vendor recommends verifying the latest releases for remediation.

The CVSS score of 10 indicates maximum severity, and the EPSS is not available, so an exploitation probability is not quantified. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is through network access to the Azure Local Disconnected Operations service where an unauthenticated user can interact with the component. If the service is reachable, this missing authentication control could be used to elevate privileges system‑wide, allowing data modification, deletion, or lateral movement.