What is the CVSS score of CVE-2025-47989?

CVE-2025-47989 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Azure Connected Machine Agent are affected by CVE-2025-47989?

A high-severity local privilege escalation flaw in the Azure Connected Machine Agent (azcmagent), the software Microsoft uses to onboard and manage servers through Azure Arc, could allow an attacker…

How to fix or mitigate CVE-2025-47989?

Within 24 hours, inventory every host running the Azure Connected Machine Agent to establish the true scope of exposure, confirm the agent's installed version against the Microsoft advisory, and verify that local account provisioning and password policies follow least privilege; ensure monitoring and alerting is enabled on azcmagent service activity and on privilege-related events in the host audit logs, and circulate an internal advisory to server and identity teams so the risk is understood. Within 7 days, conduct a review and cleanup of local accounts across the Azure Arc-connected fleet, removing or disabling unused, shared, and non-essential local accounts and restricting interactive logon rights to only those who require them; harden credential handling so that low-privileged local accounts cannot be reused or broadly known, apply MFA and privileged access controls for administrative access to these hosts, and add detection content for anomalous local privilege use or agent service manipulation. Within 30 days, adopt Microsoft's vendor-released remediation as soon as it is published - applying the vendor patch to all affected hosts on an accelerated schedule once the exact fixed azcmagent version is confirmed in the vendor advisory - and in the interim evaluate whether any Arc-connected hosts can be decommissioned from the agent or segmented behind stricter access controls; revalidate the fleet inventory and account cleanup at that point, and repeat the patch sweep on a recurring cadence until every host reports the remediated agent version. Escalate to the vulnerability management and identity teams if any host cannot be cleaned up or patched within these windows.

Azure Connected Machine Agent CVE-2025-47989

HIGH

Improper Access Control (CWE-284)

2025-10-14 secure@microsoft.com

Authentication Bypass Microsoft Azure Connected Machine Agent

7.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Local EoP needing an existing low-privileged account (PR:L) and difficult-to-meet timing conditions (AC:H), with full compromise of the host on success (C/I/A:H).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 13:01 vuln.today

CVE Published

Oct 14, 2025 - 17:15 cve.org

HIGH 7.0

DescriptionCVE.org

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Azure Connected Machine Agent (azcmagent, the Azure Arc onboarding agent) allows an authorized attacker to gain elevated privileges on an affected host. Exploitation requires the attacker to already hold an authenticated, low-privileged local account (PR:L) on a machine where the agent is installed and running; the vector is strictly local (AV:L) with high attack complexity (AC:H) and no user interaction (UI:N), and it can deliver high confidentiality, integrity, and availability impact, yielding a CVSS 3.1 base score of 7.0. EPSS is low at 0.56% (45th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis, so this is a moderate-priority local escalation rather than a top-tier emergency.

Technical ContextAI

This is a CWE-284 (Improper Access Control) defect in Microsoft's Azure Connected Machine Agent, the software installed on servers and workstations to onboard them to Azure Arc. Because the agent typically runs as a privileged service and manages configuration and credential material, weak access controls over agent-owned resources (files, registry keys, named pipes, or service interfaces) can let a low-privileged local user act with the agent's higher privileges. The high attack complexity (AC:H) in the assessed CVSS 3.1 vector implies the weakness is not a trivial, deterministic privilege grant - it likely depends on a race condition, precise timing, or a specific non-default state the attacker cannot reliably control, which reduces the chance of dependable, repeatable exploitation. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) confirms a local, post-foothold escalation requiring an authenticated low-privileged session with no UI interaction; the CPE entry cpe:2.3:a:microsoft:azure_connected_machine_agent with wildcard versioning indicates the flaw is tracked against the agent as a whole rather than one fixed release. The specific configuration or feature that exposes the improper access control is not detailed in the provided data and should be confirmed against the MSRC advisory.

RemediationAI

Apply the vendor fix for the Azure Connected Machine Agent by upgrading to the patched release documented in the Microsoft MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-47989; the provided data confirms an advisory and patch path but does not include an exact fix version, so treat this as patch-available-per-vendor-advisory and confirm the specific version string on the MSRC page before rollout. Because exploitation is local and requires an existing low-privileged account (PR:L) on a machine running the agent, the most effective compensating controls are reducing the local attack surface on Arc-onboarded hosts: audit and remove unnecessary local interactive accounts and restrict who may log on locally to machines running azcmagent, since the attack cannot be launched remotely and an initial local foothold is a hard prerequisite. Where immediate patching is not possible, prioritize the most exposed hosts, monitor for unexpected privilege changes or suspicious child processes spawned by the agent service, and tighten permissions on agent-owned files, services, and communication channels to make the access-control gap harder to reach. Note that restricting local logon may impede legitimate administrative workflows, and monitoring or ACL tightening are detection- and hardening-only measures that do not remove the underlying CWE-284 weakness - patching remains the only complete fix.