Product:
Azure Compute Gallery
Summary
A permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally. This vulnerability can lead to significant security risks if exploited. Attackers with high privileges can manipulate the system to gain unauthorized access.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.7 | CVE-2026-23651 |
Exploitation
To exploit this vulnerability, an attacker must have authorized access to the system and can then leverage the permissive regular expression to escalate their privileges. This can be done by crafting specific inputs that the regular expression fails to validate properly, allowing the attacker to execute unauthorized commands or access sensitive data.
Affected Products
- Azure Compute Gallery: A service that allows users to manage and share images for virtual machines.
Mitigation
To mitigate this vulnerability, it is recommended to review and update the regular expressions used in Azure Compute Gallery to ensure they are not permissive. Implementing stricter validation and access controls can help prevent unauthorized privilege escalation.