Microsoft's Security Update Guide published it on 22 October 2026 at 07:00 US Pacific time (14:00 UTC; 10:00 pm Perth) CVE-2026-110063, 'VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability': improper link resolution before file access ('link following', CWE-59) in VM Inspector for Azure Virtual Machines allows an unauthorised attacker to elevate privileges over a network. Microsoft rates it Critical with a CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Microsoft's FAQ says the vulnerability has already been fully mitigated by Microsoft, there is no action for users of the service to take, and the CVE is published to provide further transparency.

Microsoft lists it as not publicly disclosed and not exploited. It was one of six Microsoft cloud-service CVEs published that day; the others are on their own desk cards. Primary: Microsoft Security Response Center; CVE record.