EUVD-2026-29710
GHSA-xw2m-f6w8-j766
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Local vector confirmed by CWE-426 path manipulation; PR:L because a standard user account suffices; S:C and I:H reflect privilege escalation to the agent's elevated context; C:N and A:N per description.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Azure Monitor Agent Metrics Extension (versions below 1.42.0) allows an authenticated low-privileged local attacker to elevate privileges by exploiting an untrusted search path condition (CWE-426). The agent process resolves executable or library paths from an attacker-controllable location, enabling substitution of malicious code that executes in a higher-privileged security context (S:C). No public exploit code has been identified at time of analysis, and EPSS stands at 0.05% (17th percentile), indicating minimal observed exploitation pressure.
Technical ContextAI
CWE-426 (Untrusted Search Path) arises when a process resolves a binary, library, or script using an attacker-influenced search order - typically through PATH environment variable manipulation, writable directories preceding trusted ones, or DLL search order hijacking on Windows. Azure Monitor Agent Metrics Extension (CPE: cpe:2.3:a:microsoft:azure_monitor_agent_metrics_extension:*:*:*:*:*:*:*:*) is the Microsoft-supplied agent responsible for emitting infrastructure metrics from Azure VMs and Arc-connected on-premises servers to Azure Monitor. Because the metrics extension process runs in an elevated context (SYSTEM or a privileged service account), a low-privileged local user who can place a crafted file earlier in the unvetted search path can cause the agent to load and execute attacker-controlled code with those elevated privileges. The CVSS Scope:Changed metric confirms the impact escapes the attacker's own security boundary.
RemediationAI
Upgrade Azure Monitor Agent Metrics Extension to version 1.42.0 or later, as confirmed by the vendor fix range (1.0.0 < 1.42.0) documented in EUVD-2026-29710. The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42830 is the authoritative source for deployment guidance and release packages. On Azure VMs, the agent extension can typically be updated via the Azure Portal (Extensions blade), Azure CLI (az vm extension set), or Azure Policy auto-update enforcement. As a compensating control pending patching, restrict local interactive login and SSH/RDP access on affected hosts to trusted accounts only, and audit writable directories that appear in the PATH or working directory of the Azure Monitor Agent Metrics Extension service process - removing or restricting write permissions to those directories prevents path substitution. Note that PATH hardening may require testing to avoid disrupting legitimate agent operations.
Same weakness CWE-426 – Untrusted Search Path
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today