MSRC-CVE-2026-47643 — Azure Stack Edge Remote Code Execution Vulnerability

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An attacker could send a specially crafted file upload request that includes a manipulated file name or path. Because the application does not properly restrict or validate this input, the attacker could cause the file to be written outside the intended folder, potentially overwriting or creating files in other locations on the system.

Security updates
3.3.2604.3097 — https://learn.microsoft.com/en-us/azure/databox-online/azure-stack-edge-gpu-2604-release-notes

Vulnerabilities 1

Critical 9.8

CVE-2026-47643

Azure Stack Edge Remote Code Execution Vulnerability

External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network.

Microsoft Azure Stack Edge Browsers

Jun 9, 2026

Revision history

2026-06-09 #1
Information published.

References

CVE-2026-47643 Azure Stack Edge Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47643
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss