CVE-2026-47643: Azure Stack Edge Remote Code Execution Vulnerability

Synopsis

External control of file name or path in Microsoft Azure Stack Edge allows an unauthenticated remote attacker to execute arbitrary code over the network. No authentication or user interaction is needed; the attacker only needs network access to a vulnerable Azure Stack Edge instance running a version between 2.2.0 and 3.3.2604.3097. Successful exploitation gives the attacker full code execution on the target, enabling complete confidentiality, integrity, and availability impact. A patched-image rebuild at version 3.3.2604.3097 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Azure Stack Edge service over the network; the vulnerability is exposed remotely without requiring LAN or physical proximity.

• AuthenticationNot required

  No credentials or account of any privilege level are needed; the attack can be launched by any unauthenticated party with network access.

• Victim interactionNot required

  No user or administrator action is required to trigger exploitation; the attacker operates entirely without involving a human target.

• Attack complexityDetail

  Exploit complexity is low, meaning the attack is reliable and requires no special preconditions such as race conditions or specific memory layout.

Blast Radius

• A successful attacker executes arbitrary code in the context of the Azure Stack Edge process, gaining a foothold on the host.
• All data accessible to that process is readable, including configuration files, secrets, and any customer data transiting the device.
• The attacker can write or overwrite files, modify configuration, and alter processing pipelines on the device.
• The attacker can crash or halt the Azure Stack Edge service, disrupting edge workloads and any dependent applications.