CVE-2026-41098: Azure Stack Edge Spoofing Vulnerability

Synopsis

Cross-site scripting (XSS) in Azure Stack Edge allows an attacker with admin-level credentials to inject malicious scripts into web pages generated by the device management interface, exploiting them over the network when a victim loads an affected page. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability in the context of the victim's session, and the changed scope means impact can extend beyond the immediately vulnerable component. A patched-image rebuild at version 3.3.2604.3097 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Azure Stack Edge management interface over the network to deliver the malicious payload.

• AuthenticationRequired

  A high-privilege (admin) account is required; the attacker cannot exploit this without first obtaining elevated credentials.

• Victim interactionRequired

  A victim must load or interact with the injected page for the XSS payload to execute, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific environmental factors once the prerequisites are met.

Blast Radius

• Reads session tokens, cookies, and any credentials or sensitive data visible in the victim's browser session.
• Modifies page content or injects actions that alter configuration state through the victim's authenticated session.
• Crashes or degrades the management interface by injecting destructive scripts that consume resources or trigger errors.
• Scope change (S:C) means impact can reach components beyond the vulnerable interface itself, including adjacent services that trust the management plane.