---
id: "CVE-2026-110063"
kind: "vulnerability"
aliases: ["CVE-2026-110063"]
title: "Azure VM Inspector: link following lets attacker gain elevated privileges"
severity: "critical"
cvss: 10.0
epss: 0.00888
exploited: false
status: "resolved"
category: "vendor"
products: []
ecosystems: []
tags: ["azure", "cloud-service", "infrastructure", "vendor", "virtual-machines", "vm-inspector"]
not_affected_if: []
published_at: "2026-10-22T22:18:00+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110063", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:59:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-110063", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Azure VM Inspector: link following lets attacker gain elevated privileges

VM Inspector for Azure Virtual Machines follows symbolic links before accessing files, so an unauthorized attacker can redirect file access. The attacker can elevate privileges over the network.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110063
- 2026-10-23T21:59:27+00:00 analyst — MSRC page read: cloud-service CVE, no action required, not publicly disclosed, not exploited, exploit maturity Unproven, no build numbers. Linux vs Windows extension is not stated; the advisory says only 'VM Inspector for Azure Virtual Machines'. Credit: wtm (Offensi). X shows 7 posts today for the CVE id, not pulled; likely feed bots. Severity left at critical per the vendor's CVSS 10.0.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-110063

## Documents

- [advisory] MSRC: VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-110063

## From the sources

Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_