Microsoft: VM Inspector for Azure Virtual Machines elevation of privilege via link following (CVE-2026-110063)
Severity: critical · Patch status: patched · Since 2026-10-22 · CVE-2026-110063
Microsoft published an advisory on 2026-10-22 for CVE-2026-110063, an improper link resolution before file access ('link following') flaw in VM Inspector for Azure Virtual Machines. The vulnerability allows an unauthorized attacker to elevate privileges over a network, meaning an attacker with network access to a VM using the VM Inspector component could gain higher privileges. Azure Virtual Machines customers using VM Inspector are affected. Microsoft's Security Update Guide lists the issue as remediated via a security update; no in-the-wild exploitation is reported in the source. Organizations running affected Azure VMs should apply the update promptly and review VM access controls.
What to do
- Apply Microsoft's October 2026 security update for VM Inspector on affected Azure virtual machines
- Audit which VMs have VM Inspector enabled and prioritise internet-exposed and multi-tenant hosts
- Review Azure RBAC assignments and VM network rules for privilege changes you cannot account for
- Track the MSRC entry for this CVE for an exploitation-status update before treating the estate as remediated
Sources
All live incidents on Threat Watch
