Microsoft VM Inspector for Azure VMs: Elevation of privilege via link following

Summary

VM Inspector for Azure Virtual Machines contains an improper link resolution flaw (CWE-59, link following) before file access. A network-based attacker without privileges or user interaction could exploit it to elevate privileges, and the CVSS base score is 10.0 (Critical). Microsoft states that the issue has already been fully mitigated on its side and requires no customer action; the NVD entry was still awaiting analysis at the time of research.

Affected

• Microsoft VM Inspector for Azure Virtual Machines
• Affected versions: Unknown. Microsoft does not publish version numbers for this service.

Fixed in

• Fixed by Microsoft server-side; the issue is reported as fully mitigated.
• No customer patch or version update required.

Workaround

• None needed according to Microsoft, as the fix is server-side.

Exploitation

• Exploited in the wild: No evidence found.
• Public proof of concept: None known.
• CISA SSVC: Exploitation none, automatable yes, technical impact total.

Our recommendation

• No patch action is needed according to Microsoft.
• Check whether VM Inspector for Azure Virtual Machines is used in your Azure subscriptions.
• Recheck the Microsoft Security Update Guide and NVD for version data and exploitation updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  mehmet-emir-eroglu/CVE-2026-110063

Research sources

• Microsoft Security Update Guide: CVE-2026-110063 msrc.microsoft.com
• VulDB: CVE-2026-110063 vuldb.com
• Helix Threat Watch: CVE-2026-110063 helix.ml
• Strix: CVE-2026-110063 www.strix.ai
• ThreatInt: CVE-2026-110063 cve.threatint.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 13:56.