External risk intelligence

Azure DNS Missing Authorization Privilege Escalation

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-58275

Azure DNS is a public-facing cloud service designed to be reachable via the internet for name resolution and zone management. As a core infrastructure component accessible over the network, it is public-facing by design in normal use.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Azure DNS that could allow an unauthorized attacker to gain elevated privileges. This issue stems from missing authorization controls within the service, potentially impacting its network security and the integrity of DNS management. The primary concern is to confirm if our environment is affected by this exposure.

Unauthorized privilege escalation in Azure DNS.
Publicly accessible cloud service, high criticality.
Confirm relevance and exposure immediately.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests over the network to Azure DNS. This bypasses authorization checks, potentially allowing the attacker to gain unauthorized administrative control. The vulnerability could lead to significant disruption and unauthorized modification of DNS records.

No prior access is needed.
Triggered by network requests.
Risk of privilege escalation and data alteration.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Azure DNS could allow an unauthorized attacker to gain elevated privileges over a network, potentially impacting the integrity and availability of DNS services when supported by the advisory.

Azure DNS zone management is at risk.
Exposure can occur over a network.
Unauthorized privilege escalation is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

An attacker could exploit this vulnerability in Azure DNS to elevate privileges over a network. Understanding where Azure DNS is deployed and its criticality is the first step. Teams responsible for cloud infrastructure, application platforms, and network security should collaborate to identify affected resources, confirm exposure, and plan remediation based on risk.

Cloud infrastructure and platform teams own this issue.
Verify Azure DNS exposure and critical assets first.
Plan remediation, considering vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Azure DNS?

Azure DNS is a cloud-based hosting service for DNS domains that provides name resolution using Microsoft's global infrastructure. It allows organizations to manage their public and private DNS zones, mapping human-readable domain names to IP addresses so that web applications and services can be located and accessed across the internet or private networks.

What does CWE-862 mean for CVE-2026-58275?

CWE-862 refers to Missing Authorization. In the context of CVE-2026-58275, this means the Azure DNS service fails to verify if a user has the proper permissions before performing sensitive management actions. Because these checks are absent, an unauthorized party can execute commands as if they were a privileged administrator, bypassing the security boundaries intended to protect DNS zone configurations.

How is this Azure DNS vulnerability triggered?

The vulnerability is triggered when an attacker sends specially crafted network requests to the Azure DNS service. Because the system lacks necessary authorization checks, it processes these malicious requests as legitimate administrative commands. Importantly, an attacker does not need any pre-existing credentials or prior access to the environment to initiate these requests; the path is open to any actor capable of reaching the service over the network.

Is my environment at risk from this CVE?

According to Halo Surface Signal, Azure DNS is a public-facing cloud service designed to be reachable via the internet for name resolution and zone management. Because it is a core infrastructure component accessible over the network by design, any organization utilizing Azure DNS for domain management should consider their instances potentially reachable and within the scope of this vulnerability.

What should I do first to address CVE-2026-58275?

Start by identifying all Azure DNS zones and infrastructure currently active in your cloud environment. Coordinate with your cloud platform and infrastructure security teams to map these assets and determine which are critical to your operations. Once you have an inventory, monitor official Microsoft update channels for patches or guidance on hardening your DNS configurations to mitigate the authorization weakness.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58275

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.