CVE-2026-110063

Summary

The VM Inspector for Azure Virtual Machines fails to properly resolve symbolic links before accessing files, allowing an unauthenticated attacker over the network to read or write files outside intended directories and thereby elevate privileges.

Exploitability

Exploitation requires network access to the vulnerable VM Inspector endpoint and knowledge of a target file path that can be leveraged via symlink manipulation; no authentication is needed.

Blast radius

Successful exploitation grants full compromise of confidentiality, integrity, and availability on the affected system, potentially enabling lateral movement or persistence within Azure infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to VM Inspector version 2.590 or later, as this version includes the fix for improper link resolution.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.