CVE-2026-118742

HighCVSS 8.6/10Last modified Nov 10, 2026

Description

Incorrect permission assignment for critical resource in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-732

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
MicrosoftAzure Front Door>= 1.0.0, < publication

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1187458.8Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.CVE-2026-1187466.8Not failing securely ('failing open') in .NET allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-1187477.5Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-1187487.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-1187497.5Inefficient algorithmic complexity in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-118755.3The WP Support Plus Responsive Ticket System WordPress plugin through 9.1.2 does not sign or verify its guest-session cookie, allowing unautCVE-2026-1187507.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-1187527.8FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.22 contain a heap buffer overflow vulnerability in the PBM RLE decoder oCVE-2026-1187537.8FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.25 contain a heap buffer overflow vulnerability in PluginGIF.cpp that alCVE-2026-1187545.3Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticaCVE-2026-1187557.2Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute sCVE-2026-1187565.5gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories o
CVE-2026-118742: High severity, CVSS 8.6 | Vulnix