Azure Monitor Agent
CVE-2025-59285
HIGH
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation by an authenticated low-priv user (AV:L, PR:L); AC:H reflects deserialization preconditions; successful exploit yields full local compromise (C:H/I:H/A:H), scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft Azure Monitor Agent (CPE cpe:2.3:a:microsoft:azure_monitor_agent, all versions covered by the wildcard) lets an attacker who already holds authenticated, low-privileged access on the host feed attacker-controlled serialized data into an unsafe deserialization path and gain elevated privileges - code execution, confidentiality and integrity impact are all rated High, confined to the local system (S:U). This is a moderate-priority, not a drop-everything issue: the attack is local-only with high complexity (AV:L/AC:H/PR:L/UI:N), EPSS is 0.78% (55th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis. Exploitation is contingent on a pre-existing foothold plus the specific agent feature, version, and configuration that expose the vulnerable deserialization path - details that must be confirmed against the MSRC advisory.
Technical ContextAI
The root cause is CWE-502, Deserialization of Untrusted Data, in the Microsoft Azure Monitor Agent. Deserialization flaws of this class occur when an application reconstructs objects from a byte/string stream supplied by an untrusted source without type or integrity constraints; depending on the serializer and the types reachable on the deserialization graph, an attacker can influence object construction, invoke gadget chains, or set properties that were never meant to be attacker-controlled, converting a data-parsing step into code execution within the security context of the deserializing process. In this case the process runs as the Azure Monitor Agent service, so successful abuse yields privilege elevation above the attacker's starting level. The CVSS vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H indicates the trigger is local, requires an authenticated low-privileged principal, needs no user interaction, and has meaningful preconditions (AC:H, e.g. winning a race or controlling specific input state) rather than being trivially repeatable; scope is unchanged, so the blast radius stays inside the host's privilege boundary instead of crossing a security authority. The available data does not identify which serialization format or agent component is affected, so the precise gadget surface should be treated as unconfirmed pending the MSRC advisory.
RemediationAI
No fixed version number is included in the supplied intelligence, so the primary action is to pull the exact patched build for each platform directly from the Microsoft MSRC update guide for CVE-2025-59285 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59285) - patch status should be recorded as 'available per vendor advisory' until that build number is confirmed, and the agent should be upgraded on every monitored host rather than only internet-facing ones. Because the attack requires an authenticated low-privileged local principal, the most effective compensating control is to shrink the population of principals that can reach the vulnerable path: audit and remove unnecessary local interactive/RDP rights on monitored servers, and verify that the agent's configuration, extension and data directories (and any IPC endpoints or named pipes it exposes) are writable only by Administrators/SYSTEM or root-equivalent accounts; tightening these ACLs will break third-party tooling or scripts that currently write agent configuration as a non-privileged user, so stage the change on a pilot ring. Enable Windows Defender Application Control / SELinux or AppArmor confinement around the agent process to blunt arbitrary process creation or module load if deserialization is abused, and forward agent service logs plus Sysmon process-creation and image-load events to a central SIEM to catch post-exploitation behavior. Where patching must be deferred and the local-attacker prerequisite cannot be reduced, isolate the agent host role so that a single elevated local account yields no additional lateral movement value, and re-run agent inventory frequently since AMA auto-updates can silently close the exposure.
More in Azure Monitor Agent
View allAzure Monitor Agent Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.4), this vulnerability is low atta
Command injection in Azure Monitor Agent Linux Extension (versions 1.0.0 through pre-1.43) enables privilege escalation
Privilege escalation in Microsoft Azure Monitor Agent lets a locally authenticated, low-privileged user on a monitored h
Azure Monitor Agent Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low atta
Improper control of generation of code ('code injection') in Azure Monitor Agent allows an unauthorized attacker to exec
Azure Monitor Agent Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is low atta
Azure Monitor Agent Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.1), this vulnerability is low atta
Heap-based buffer overflow in Azure Monitor Agent allows an unauthorized attacker to execute code locally. Rated high se
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today