What is the CVSS score of CVE-2026-26141?

CVE-2026-26141 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Azure Automation Hybrid Worker Windows Extension are affected by CVE-2026-26141?

CVE-2026-26141 is a privilege escalation vulnerability in Azure Arc that could allow authorized users to gain elevated system access without proper authentication controls.. A patch is available.

How to fix or mitigate CVE-2026-26141?

Within 24 hours: Identify all Azure Arc deployments in your environment and document which systems are running vulnerable versions. Within 7 days: Implement network segmentation to restrict Azure Arc communication to trusted networks only, disable Azure Arc on non-critical systems where feasible, and enable enhanced logging for all Arc authentication events. Within 30 days: Monitor Microsoft security advisories for patch availability, conduct a privilege access review for all Azure Arc service accounts, and implement multi-factor authentication for all administrative access to Arc-managed resources.