Improper access control in Azure App Service

CVE-2026-58630 is an *improper access control* flaw (CWE-284) in the App Service resource provider on Azure Stack Hub — Microsoft's on-premises hybrid-cloud appliance. Per the July 23 advisory, an unauthenticated network-adjacent attacker can bypass authorization boundaries to elevate privilege inside the App Service RP, potentially reading tenant deployment credentials, publishing profiles, and service-to-service tokens. Affected versions are not enumerated in the advisory; Microsoft directs operators to cross-reference their Azure Stack Hub build+hotfix level against App Service release notes. The public Azure PaaS *.azurewebsites.net fleet is not in scope.

The vendor's CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) is technically correct — the vector chain is genuinely unauthenticated, network-reachable, with a scope change into other tenants — but the label is misleading in operational terms. Azure Stack Hub is a niche appliance (sovereign cloud, defense, disconnected edge). The blast radius per deployment is legitimately high because you're breaking multi-tenant isolation, but the *reachable population* is a rounding error compared to what 'Azure App Service CRITICAL 10' suggests to a triage queue. That mismatch is why we drop this to HIGH, not because the bug is weak.

Why this verdict

• Product scope narrows the population by ~1000x: vendor CRITICAL 10 implies every App Service tenant on Earth, but MSRC scopes this to Azure Stack Hub only. Baseline drops from 'internet-facing PaaS' to 'niche on-prem appliance.'
• Management plane is internal by design: Stack Hub tenant and admin portal endpoints are almost universally on segmented VLANs, not routable from the internet. AV:N is technically true but the reachable N is tiny.
• No PoC, no KEV, no observed campaigns 24 hours post-disclosure. First public exploitation typically lags Stack Hub advisories by weeks or is never observed at all.
• Role multiplier — App Service RP is a multi-tenant control plane: if the chain lands, tenant isolation breaks and MSI tokens / publishing profiles leak across tenants on that Stack Hub. That is the CRITICAL-floor blast radius for a PaaS host, which is why we do not drop below HIGH.
• Role multiplier — Stack Hub deployments skew sovereign/defense/telco-edge: the small population that IS affected tends to run high-consequence workloads, so a HIGH is not a shrug — it is a real 30-day-mitigate obligation for that subset.

Why not higher?

CRITICAL would be appropriate if this hit public Azure App Service or if there were an active PoC. Neither is true: the population is a small on-prem appliance base, management endpoints are internal, and no weaponization exists 24h in. Reserving CRITICAL for cases with real-world exploitability keeps the queue meaningful.

Why not lower?

MEDIUM would ignore the role multiplier — the affected component is a multi-tenant PaaS control plane, and a successful chain breaks tenant isolation. Any bug that leaks credentials across tenant boundaries on a hosting platform floors at HIGH, even with a small install base and no PoC.

1. Confirm Stack Hub App Service RP build level against MSRC guidance — Log into the Stack Hub admin portal, check the App Service RP version, and compare to the fixed build listed on the MSRC advisory. If below, you are exposed. Do this within the noisgate mitigation SLA of 30 days for HIGH.
2. Restrict management-plane reachability to a jumphost VLAN — Confirm that tenant and admin portal endpoints are unreachable from user LANs, VPN pools, and the internet. Enforce jumphost-only access with MFA and client certificates. This is the single highest-leverage mitigation while awaiting the RP hotfix.
3. Rotate all App Service tenant deployment credentials — Rotate publishing profiles, Kudu SCM credentials, deployment tokens, and any static tenant automation secrets. If the bug has been latent, assume these may already be harvested. Complete within 30 days.
4. Enable and forward Stack Hub audit + App Service Kudu logs to SIEM — Add detections for anonymous or unexpected-principal calls into Microsoft.Web/* provider paths, and for Kudu deployment activity from IPs outside your CI/CD ranges. Backdate the hunt 30 days once deployed.
5. Apply Microsoft's App Service RP hotfix as soon as it reaches your update channel — Stack Hub patches follow the update package cadence, not Patch Tuesday. Schedule the patching maintenance window within the noisgate remediation SLA of 180 days, ideally much sooner given the tenant-isolation blast radius.

Run this from a Stack Hub operator workstation with the Az.Stack / AzureStack PowerShell modules installed and an admin login to the Stack Hub admin ARM endpoint. Invoke as: .\Check-CVE-2026-58630.ps1 -AdminArmEndpoint 'https://adminmanagement.<region>.<fqdn>' -FixedBuild '2026.07.0'. Requires Stack Hub *operator* role to read the RP version.

#requires -Modules AzureStack
# Check-CVE-2026-58630.ps1
# Reports whether the App Service resource provider on this Azure Stack Hub
# stamp is at or above the fixed build for CVE-2026-58630.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

param(
    [Parameter(Mandatory=$true)][string]$AdminArmEndpoint,
    [Parameter(Mandatory=$true)][string]$FixedBuild  # from MSRC advisory, e.g. '2026.07.0'
)

$ErrorActionPreference = 'Stop'

try {
    # Assumes operator has already run Add-AzEnvironment + Connect-AzAccount to the admin endpoint
    $ctx = Get-AzContext
    if (-not $ctx) { Write-Error 'Not logged in. Run Connect-AzAccount against the Stack Hub admin endpoint first.'; exit 2 }

    # Query the App Service resource provider status
    $rp = Get-AzsAppServiceStatus -ErrorAction Stop

    if (-not $rp -or -not $rp.Version) {
        Write-Output 'UNKNOWN - App Service RP not installed or version unreadable'
        exit 2
    }

    $installed = [version]$rp.Version
    $fixed     = [version]$FixedBuild

    Write-Output "Installed App Service RP: $installed"
    Write-Output "Fixed build required:     $fixed"

    if ($installed -ge $fixed) {
        Write-Output 'PATCHED'
        exit 0
    } else {
        Write-Output 'VULNERABLE - upgrade App Service RP to the MSRC-listed build'
        exit 1
    }
}
catch {
    Write-Output "UNKNOWN - $($_.Exception.Message)"
    exit 2
}

Sources

1. MSRC Security Update Guide — CVE-2026-58630
2. Windows News — July 23 Advisory: CVE-2026-58630 Azure Stack Hub App Service EoP
3. TheHackerWire — Critical Azure App Service Privilege Escalation
4. Azure App Service on Azure Stack Hub — release notes
5. Azure App Service Security FAQs — Microsoft Learn
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS
8. CWE-284: Improper Access Control