Microsoft disclosed an elevation‑of‑privilege flaw in Azure DNS that could allow unauthorized DNS modifications, urging customers to review RBAC and tighten identity controls.

Microsoft has disclosed a critical elevation‑of‑privilege vulnerability, identified as CVE‑2026‑58275, affecting Azure DNS services. The flaw could let attackers with limited access modify DNS records, potentially redirecting traffic or disrupting services for affected tenants.

Understanding the CVE‑2026‑58275 Flaw

The vulnerability stems from improper validation of role‑based access control (RBAC) permissions within the Azure DNS management plane. An attacker who gains a low‑privilege role, such as DNS Zone Reader, may be able to elevate their rights and perform write operations on DNS zones they should only view.

Microsoft’s investigation revealed that the issue is exploitable via the Azure REST API and PowerShell cmdlets, allowing crafted requests to bypass standard permission checks. The bug does not affect the DNS data plane, but any successful exploitation could lead to unauthorized record changes.

Immediate Mitigation Steps

  • Review all Azure DNS RBAC assignments and ensure only trusted principals have Contributor or higher roles.
  • Restrict the use of shared service principals and remove unnecessary legacy permissions.
  • Enable Azure AD Conditional Access policies for privileged accounts that manage DNS zones.
  • Apply the latest Azure DNS service update released on July 24, 2026.

After adjusting permissions, verify that no unexpected changes have occurred in your DNS zones by comparing current records against a known good baseline. Use Azure Monitor logs to audit DNS management activity for any anomalies.

Long‑Term Hardening Recommendations

Beyond the immediate fixes, Microsoft advises customers to adopt a zero‑trust approach for DNS management. This includes implementing just‑in‑time (JIT) access, employing multi‑factor authentication for all privileged accounts, and regularly rotating service principal secrets.

Consider integrating Azure Policy to enforce RBAC standards across subscriptions, and enable Microsoft Defender for Cloud’s DNS protection to receive real‑time alerts on suspicious modifications.

Customers should treat this as a high‑severity issue and act promptly to prevent potential domain hijacking.

For a detailed walkthrough of the remediation process, see Windows News coverage of Azure DNS vulnerability CVE‑2026‑58275.