CVE-2026-23651 Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability

Medium 6.7 Published 5 Mar 2026 Updated 19 Jun 2026

An authorized attacker can elevate privileges locally due to a permissive regular expression in Azure Compute Gallery.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-23651?

CVE-2026-23651 is a medium-severity vulnerability in Microsoft ACI Confidential Containers, published on 5 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.

Weakness: CWE-625

Which versions are affected by CVE-2026-23651?

It affects 1 product.

Products include Microsoft Aci Confidential Containers.

How do I fix CVE-2026-23651?

No fix has been published for CVE-2026-23651 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-23651 being exploited?

There is no known exploitation of CVE-2026-23651 in the wild and no public exploit code.

Sources

Also known as GHSA-pv25-75q9-7735.