CVE-2026-26148
Published: 10 March 2026
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2026-26148, published on 2026-03-10, is a vulnerability involving external initialization of trusted variables or data stores in Azure Entra ID. This flaw, classified under CWE-454 (External Initialization of Trusted Variables or Data Stores) and NVD-CWE-noinfo, carries a CVSS v3.1 base score of 8.1 (AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts with a changed scope.
An unauthorized attacker with local access (AV:L) can exploit this vulnerability despite requiring no privileges (PR:N). The attack demands high complexity (AC:H) and no user interaction (UI:N), but successful exploitation enables privilege escalation locally, resulting in high impacts across confidentiality, integrity, and availability (C:H/I:H/A:H) within a changed scope (S:C).
For mitigation details, refer to the official advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26148.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability enables local privilege escalation through exploitation, directly mapping to T1068: Exploitation for Privilege Escalation.