Azure NFS mount helper (aznfs): Local privilege escalation via untrusted search path
Summary
Microsoft's aznfs, a client utility that sets up encrypted TLS tunnels for NFSv4.1 mounts of Azure file shares, contains an untrusted search path flaw (CWE-426). A local attacker with low privileges can use it to elevate privileges, with high impact on confidentiality, integrity and availability. Exploitation requires an existing local foothold, such as a compromised service account or access to a shared Linux VM where aznfs is installed.
Affected
- Microsoft aznfs from 1.0.0.0 before 3.0.20
Fixed in
- Update to aznfs 3.0.20 or later (minimum target based on the affected range; confirm the fixed build in the MSRC advisory)
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild found.
- Not listed in CISA KEV according to a third-party tracker.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- The Microsoft CVSS vector includes E:P (proof-of-concept maturity), but no public PoC was found.
- Rapid7 rates exploitation as less likely.
Our recommendation
- Inventory Linux hosts for the aznfs package and record their versions.
- Update to aznfs 3.0.20 or later once the fixed build is confirmed by MSRC.
- Until patched, restrict local shell access on affected hosts and review who holds it.
- Prioritise multi-user or shared Linux hosts; lower priority on single-admin VMs.
- Monitor the MSRC advisory for updates, as conflicting third-party descriptions have not been clarified.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-105494 www.cve.org
- Microsoft Security Response Center advisory CVE-2026-105494 msrc.microsoft.com
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
- Strix CVE-2026-105494 (third-party tracker) www.strix.ai
- Cloud Vulnerability DB: aznfs mount privilege escalation (related 2025 issue) www.cloudvulndb.org
- Microsoft Learn: Encryption in transit for NFS shares learn.microsoft.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 04:37.
Original description (NVD)
Untrusted search path in Azure NFS mount helper (aznfs) allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.