Is CVE-2026-47280 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47280 being exploited in the wild.

How severe is CVE-2026-47280?

Critical severity, with a CVSS score of 10, published 22 May 2026.

Which products and versions are affected?

Microsoft Azure Resource Manager (ARM).

Is there a fix for CVE-2026-47280?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-47280 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-47280?

Check whether you run Microsoft Azure Resource Manager. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47280: Microsoft Azure Resource Manager improper authentication privilege escalation

CVE-2026-47280 · Severity: critical · CVSS 10 · Published 2026-05-22

A critical vulnerability exists in Microsoft Azure Resource Manager, the central management layer for all Azure cloud resources. An unauthorized attacker could exploit this flaw to gain full administrative control over cloud environments without needing any existing credentials. This could lead to total data exposure, service destruction, or unauthorized access to sensitive corporate infrastructure.

Vendors: Microsoft.

Quick answers

Is CVE-2026-47280 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47280 being exploited in the wild.
How severe is CVE-2026-47280?: Critical severity, with a CVSS score of 10, published 22 May 2026.
Which products and versions are affected?: Microsoft Azure Resource Manager (ARM).
Is there a fix for CVE-2026-47280?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-47280 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-47280?: Check whether you run Microsoft Azure Resource Manager. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A critical improper authentication vulnerability (CWE-287) exists in Azure Resource Manager (ARM). The flaw allows an unauthenticated attacker to bypass security controls over the network to achieve full privilege escalation. With a CVSS score of 10.0 and a 'Changed' Scope (S:C), an exploit could allow an attacker to move beyond the ARM management plane to impact other integrated cloud resources. No user interaction or prior privileges are required for exploitation. As ARM is an exclusively hosted service, Microsoft typically manages the remediation on the backend.

Affected products

Microsoft Azure Resource Manager (ARM)

Timeline

2026-05-22: disclosed: Initial publication of CVE-2026-47280

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47280

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.