2026-05-21ROUTINEAzure Local Disconnected Operations CVE-2026-42822 scores 10.0, but Microsoft's realistic attacker is an insider
Microsoft Azure Local Disconnected Operations
product · product:microsoft-azure-local-disconnected-operations single-source
Coverage
1
first 2026-05-21 → last 2026-10-21
Latest activity
2026-05-21
Azure Local Disconnected Operations CVE-2026-42822 scores 10.0, but Microsoft's realistic attacker is an…
Peak priority
routine
1 routine
Targets
·
no sector or region stated
Sources cited
1
1 hosts
Defender insights
What each entry about Microsoft Azure Local Disconnected Operations tells a defender to do, newest first.
Exposure
Story timeline
Hunting pivots
CVEs
Releases covered
Microsoft Azure Local Disconnected Operations
ATT&CK techniques (2 across 4 tactics)
2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)
- Initial AccessValid Accounts
- PersistenceValid Accounts
- Privilege EscalationExploitation for Privilege Escalation · Valid Accounts
- StealthValid Accounts
Initial Access TA0001
T1078Valid Accounts×1
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Evidence: 2026-05-21/cve-2026-42822-microsoft-azure-local-disconnected-operations · ATT&CK page ↗
Persistence TA0003
T1078Valid Accounts×1
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Evidence: 2026-05-21/cve-2026-42822-microsoft-azure-local-disconnected-operations · ATT&CK page ↗
Privilege Escalation TA0004
T1068Exploitation for Privilege Escalation×1
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Evidence: 2026-05-21/cve-2026-42822-microsoft-azure-local-disconnected-operations · ATT&CK page ↗
T1078Valid Accounts×1
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Evidence: 2026-05-21/cve-2026-42822-microsoft-azure-local-disconnected-operations · ATT&CK page ↗
Stealth TA0005
T1078Valid Accounts×1
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Evidence: 2026-05-21/cve-2026-42822-microsoft-azure-local-disconnected-operations · ATT&CK page ↗
Entries about Microsoft Azure Local Disconnected Operations (1)
Co-occurring entities
Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.
Where this entity is cited
Source distribution
- msrc.microsoft.com1 (100%)