The vulnerability is an improper link resolution before file access, also known as link following, in Azure Portal Windows Admin Center. This weakness allows an authorized user to execute operations with higher privileges than intended, effectively bypassing local security controls. By exploiting this flaw, an attacker can obtain privileged access and potentially compromise the entire system, leading to unauthorized modification, data disclosure, or denial of service for the compromised host.

Microsoft Windows Admin Center in Azure Portal is affected. No specific version numbers are provided; administrators should verify that all installed instances receive the fix related to CVE-2026-42834.

The CVSS score of 7.8 classifies the vulnerability as high severity. The EPSS score is not available, but the lack of a listing in CISA’s KEV catalog suggests that there are no known public exploits at this time. The attack vector is local: it requires an attacker to have authorized access to the Azure Portal. However, because the flaw enables privilege escalation, the potential impact is significant, turning a legitimate user into a full administrative entity.