Microsoft Azure Local Disconnected Operations Elevation of Privilege Vulnerability

A vulnerability allowing improper authentication in Azure Local Disconnected Operations (ALDO) has been identified, enabling unauthorized attackers to elevate privileges over a network. This issue affects customers with access to the ALDO environment.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing attackers to access restricted information or perform actions typically reserved for users with higher privileges or administrative rights.

Remediation

Customers using Azure Local Disconnected Operations must update to version 2604 or later. This update is not available as a standalone patch and must be applied as a full system update through the Azure portal. ALDO updates are only accessible to approved customers via allow-listing.