Azure Stack Hub App Service Resource Provider improper access control enabling elevation of privilege

CVE-2026-58630 is an *improper access control* flaw (CWE-284) in the App Service resource provider on Azure Stack Hub — Microsoft's on-premises hybrid-cloud appliance. Per the July 23 advisory, an unauthenticated network-adjacent attacker can bypass authorization boundaries to elevate privilege inside the App Service RP, potentially reading tenant deployment credentials, publishing profiles, and service-to-service tokens. Affected versions are not enumerated in the advisory; Microsoft directs operators to cross-reference their Azure Stack Hub build+hotfix level against App Service release notes. The public Azure PaaS *.azurewebsites.net fleet is not in scope.

The vendor's CVSS 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) is technically correct — the vector chain is genuinely unauthenticated, network-reachable, with a scope change into other tenants — but the label is misleading in operational terms. Azure Stack Hub is a niche appliance (sovereign cloud, defense, disconnected edge). The blast radius per deployment is legitimately high because you're breaking multi-tenant isolation, but the *reachable population* is a rounding error compared to what 'Azure App Service CRITICAL 10' suggests to a triage queue. That mismatch is why we drop this to HIGH, not because the bug is weak.

Sources.

1. MSRC Security Update Guide — CVE-2026-58630
2. Windows News — July 23 Advisory: CVE-2026-58630 Azure Stack Hub App Service EoP
3. TheHackerWire — Critical Azure App Service Privilege Escalation
4. Azure App Service on Azure Stack Hub — release notes
5. Azure App Service Security FAQs — Microsoft Learn
6. CISA Known Exploited Vulnerabilities Catalog
7. FIRST EPSS
8. CWE-284: Improper Access Control

Run this from a Stack Hub operator workstation with the Az.Stack / AzureStack PowerShell modules installed and an admin login to the Stack Hub admin ARM endpoint. Invoke as: .\Check-CVE-2026-58630.ps1 -AdminArmEndpoint 'https://adminmanagement.<region>.<fqdn>' -FixedBuild '2026.07.0'. Requires Stack Hub *operator* role to read the RP version.

#requires -Modules AzureStack
# Check-CVE-2026-58630.ps1
# Reports whether the App Service resource provider on this Azure Stack Hub
# stamp is at or above the fixed build for CVE-2026-58630.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

param(
    [Parameter(Mandatory=$true)][string]$AdminArmEndpoint,
    [Parameter(Mandatory=$true)][string]$FixedBuild  # from MSRC advisory, e.g. '2026.07.0'
)

$ErrorActionPreference = 'Stop'

try {
    # Assumes operator has already run Add-AzEnvironment + Connect-AzAccount to the admin endpoint
    $ctx = Get-AzContext
    if (-not $ctx) { Write-Error 'Not logged in. Run Connect-AzAccount against the Stack Hub admin endpoint first.'; exit 2 }

    # Query the App Service resource provider status
    $rp = Get-AzsAppServiceStatus -ErrorAction Stop

    if (-not $rp -or -not $rp.Version) {
        Write-Output 'UNKNOWN - App Service RP not installed or version unreadable'
        exit 2
    }

    $installed = [version]$rp.Version
    $fixed     = [version]$FixedBuild

    Write-Output "Installed App Service RP: $installed"
    Write-Output "Fixed build required:     $fixed"

    if ($installed -ge $fixed) {
        Write-Output 'PATCHED'
        exit 0
    } else {
        Write-Output 'VULNERABLE - upgrade App Service RP to the MSRC-listed build'
        exit 1
    }
}
catch {
    Write-Output "UNKNOWN - $($_.Exception.Message)"
    exit 2
}