What’s Vulnerable › Vulnerabilities
CVE-2026-26148: Microsoft Azure AD SSH Login extension for Linux Elevation of Privilege Vulnerability
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-10 · updated 2026-06-19
- Weakness: CWE-454
Description
External initialization of trusted variables or data stores in Azure Entra ID allows an unauthorized attacker to elevate privileges locally.
Affected products
- Microsoft Azure AD SSH Login extension for Linux: from 1.0.0 before 1.0.033370002 — fixed in 1.0.033370002
- Microsoft Azure AD SSH Login extension for Linux: from 1.0.0 before 1.0.033370002 — fixed in 1.0.033370002
How to fix
Upgrade to a fixed version: Microsoft Azure AD SSH Login extension for Linux 1.0.033370002; Microsoft Azure AD SSH Login extension for Linux 1.0.033370002. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-26148 or the next vulnerability affects your stack