CVE-2026-24306

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Jan 22, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-243077.5Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.CVE-2026-243087.5Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensCVE-2026-243096.4Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP functCVE-2026-24316.1The CM Custom Reports plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date_from' and 'date_to' parameters in aCVE-2026-243104.3Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP functCVE-2026-243115.6The SAP Customer Checkout application exhibits certain design characteristics that involve locally storing operational data using reversibleCVE-2026-243125.2An erroneous authorization check in SAP Business Workflow leads to privilege escalation. An authenticated administrative user can bypass rolCVE-2026-243135.0SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks for authenticated useCVE-2026-243144.3Under certain conditions SAP S/4HANA (Manage Payment Media) allows an authenticated attacker to access information which would otherwise be CVE-2026-243154.2SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by CVE-2026-243166.4SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary inteCVE-2026-243175.0SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could explo
CVE-2026-24306: Critical severity, CVSS 9.8 | Vulnix