{"id":"CVE-2026-110063","published":"2026-10-22T22:18:00.750","lastModified":"2026-10-27T04:17:42.433","description":"Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.","cvssScore":10,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-59"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110063","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The VM Inspector for Azure Virtual Machines fails to properly resolve symbolic links before accessing files, allowing an unauthenticated attacker over the network to read or write files outside intended directories and thereby elevate privileges.","exploitability":"Exploitation requires network access to the vulnerable VM Inspector endpoint and knowledge of a target file path that can be leveraged via symlink manipulation; no authentication is needed.","blast_radius":"Successful exploitation grants full compromise of confidentiality, integrity, and availability on the affected system, potentially enabling lateral movement or persistence within Azure infrastructure.","remediation":"Upgrade to VM Inspector version 2.590 or later, as this version includes the fix for improper link resolution.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","link-following","cwe-59","azure","network-exploitable"],"model":"garnet-coder","analyzedAt":"2026-10-24T08:48:28.037Z"}}