Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
How could an attacker exploit this vulnerability?
An authenticated attacker who can supply a blob tag condition to an application using the affected library could submit a specially crafted value. Successful exploitation could allow the attacker to delete recovery snapshots or blobs beyond the operation authorized by the application. User interaction is not required.
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker could add unauthorized deletion options to a permitted storage operation, allowing recovery snapshots or blobs to be deleted when the application did not intend to authorize that action.
Security updates
153.0.4234.46 — https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security
12.31.2 — https://github.com/Azure/azure-sdk-for-java/blob/main/sdk/storage/azure-storage-blob-batch/CHANGELOG.md#12312-2026-09-15
Vulnerabilities 1
-
High 8.1
Azure Storage Library Elevation of Privilege Vulnerability
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges over a network.
Revision history
-
#2
Added Edge software to the Security Updates table. Customers that are running supported version of Edge are encouraged to update to the indicated version to be protected from this vulnerability.
-
#1
Information published.
References
-
CVE-2026-88094 Azure Storage Library Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88094
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss