CVE-2026-26148

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-26148
External initialization of trusted variables or data stores in Azure Entra ID allows an unauthorized attacker to elevate privileges locally.

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.4 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26148 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:azure_ad_ssh_login_extension_for_linux:*:*:*:*:*:*:*:*
History

13 Mar 2026, 17:03

Type Values Removed Values Added
First Time Microsoft azure Ad Ssh Login Extension For Linux
Microsoft
References () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26148 - () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26148 - Vendor Advisory
Summary
  • (es) Inicialización externa de variables de confianza o almacenes de datos en Azure Entra ID permite a un atacante no autorizado elevar privilegios localmente.
CWE NVD-CWE-noinfo
CPE cpe:2.3:a:microsoft:azure_ad_ssh_login_extension_for_linux:*:*:*:*:*:*:*:*

10 Mar 2026, 18:18

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 18:18

Updated : 2026-03-13 17:03

NVD link : CVE-2026-26148

Mitre link : CVE-2026-26148

CVE.ORG link : CVE-2026-26148

JSON object : View

Products Affected

microsoft

  • azure_ad_ssh_login_extension_for_linux
CWE
CWE-454

External Initialization of Trusted Variables or Data Stores

NVD-CWE-noinfo