Azure Stack Edge Spoofing Vulnerability
CVE-2026-41098 is a spoofing vulnerability in Azure Stack Edge (rated Important, CVSS 8.4).
1 version
Facts
- Microsoft id
CVE-2026-41098- Products
- Azure Stack Edge
- Severity
- Important
- Impact
- Spoofing
- CVSS
- 8.4
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Exploitability
- Exploitation Less Likely
- Customer action required
- Yes
- Release
- 2026-Jun
- Assigned by
- Microsoft
- Weakness
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- MSRC revision
- 1.0
- Status pages
- Azure Stack Edge status
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2026-06-09:
Information published.
Microsoft says
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack Edge allows an authorized attacker to perform spoofing over a network.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page
Related changes
Other changes for Azure Stack Edge
- Azure Stack Edge Pro with GPU now generally available · Launched
- Azure Stack and Azure Data Box Edge meter name changes
- Azure Stack Edge Kubernetes system is now available · Launched
- Azure Stack Edge Mini R is now generally available · Launched
- Azure Stack Edge Pro FPGA is retiring on 29 February 2024
- Azure Stack Edge Pro R now generally available · Launched
- Azure Stack Edge Virtual Machine Support is in public preview · In preview
- Azure Data Box Edge (now Azure Stack Edge) meter name changes
Last updated