Microsoft Azure Local: Elevation of privilege through incorrect permissions

Summary

Incorrect permission assignment for a critical resource in Microsoft Azure Local allows an attacker with local, low-privileged access to elevate privileges. Successful exploitation would give the attacker high impact on confidentiality, integrity and availability of the affected host. According to Microsoft's advisory, an attack requires coordination with another privileged process, which raises the bar for attackers.

Affected

• Microsoft Azure Local from 1.0.0 before 1.2610.2.3134
• The CVE record lists the platform as "Azure Linux 3.0", which appears inconsistent with Azure Local. Confirm the affected build on the MSRC page.

Fixed in

• Update to Azure Local 1.2610.2.3134 or later, as listed in the CVE record and linked Microsoft advisory.

Workaround

Unknown.

Exploitation

• No evidence of exploitation in the wild found at the time of research.
• Microsoft's exploit code maturity is E:U (unproven).
• No public proof-of-concept found. Strix lists the CVE as not in CISA KEV.
• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.

Our recommendation

• Where Azure Local is deployed, install the security update 1.2610.2.3134 or later promptly.
• Restrict local and administrative logon on Azure Local hosts.
• Treat low-privileged accounts on these hosts as a potential escalation path and review their permissions.
• Re-check NVD and CISA KEV, as NVD analysis was still pending.
• If Azure Local is not used in your environment, no action is needed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-105734 msrc.microsoft.com
• CVE Record: CVE-2026-105734 www.cve.org
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Strix: CVE-2026-105734 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:32.