Attributed metadata history
Up to 100 retained publisher events per page for ea2f527775e2baf1c3d134c24532198c05e2e4614792171430199f4b23a26ddd. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:04 UTC
A vulnerability in the Azure Linux VM extension mechanism allowed an unprivileged user to leak any Azure VM extension’s private data. An attacker could have abused this to gain credentials for the VM itself as well as credentials for extensions associated with the VM. Paired with the design of the VMAccess extension (an official Azure extension for managing VM credentials), this could have been used to achieve privilege escalation, as an unprivileged attacker would have been able to elevate themselves to a higher privileged user by leaking the VMAccess admin password. Additionally, if the VMAccess password happened to be shared among other Azure VMs, the attacker would have been able to perform lateral movement to other machines. The root cause of this vulnerability was that the certificates endpoint used for decrypting extension credentials did not validate transport certificates, so an attacker could simply issue their own valid transport certificate. Moreover, although an iptables rule was in place to prevent unprivileged access to this endpoint, an attacker could bypass it by directing their requests to the Azure IMDS instead, which happened to be located on the same machine
Fingerprint: 4cbda3a8199c8f373e68a02f731601000ab33b1d592629e80fa0f8f122542ff1
intelligence_src_d11443da85ea659d49
observed · 2026-10-12 15:37:03 UTC
available
Fingerprint: 46fd50ac705e064c7517d97d61b5ec511c9b1ada6209622159dd39573ba08e5c