What is the CVSS score of CVE-2026-47632?

CVE-2026-47632 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Azure Monitor Agent are affected by CVE-2026-47632?

CVE-2026-47632 affects Microsoft Azure Monitor Agent, enabling attackers on the organization's network to impersonate critical monitoring infrastructure and gain elevated privileges.. A patch is available.

How to fix or mitigate CVE-2026-47632?

Within 24 hours, identify all systems running Azure Monitor Agent Metrics Extension through deployment inventory and assess network segmentation to isolate monitor agents from untrusted networks. Within 7 days, apply Microsoft's vendor-released patch to all affected systems, prioritizing production and security-critical infrastructure; verify patch deployment through agent version reporting. Within 30 days, conduct testing of monitoring functionality post-patch, review pre-patch network access logs for exploitation attempts, and document remediation completion.

Azure Monitor Agent CVE-2026-47632

EUVD-2026-43792 HIGH

Improper Certificate Validation (CWE-295)

2026-07-14 microsoft

GHSA-hhxq-vhpq-pjf3

Authentication Bypass Microsoft Azure Monitor Agent Metrics Extension

8.8

CVSS 3.1 · Vendor: microsoft

Temporal: 7.7

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

7.7 HIGH

cvss

vuln.today AI

8.8 HIGH

Adjacent MITM position (AV:A) with no auth or interaction; improper cert validation grants full agent-context compromise, giving high C/I/A within an unchanged scope.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:39 vuln.today

CVE Published

Jul 14, 2026 - 17:05 nvd

HIGH 8.8

DescriptionCVE.org

Improper certificate validation in Azure Monitor Agent allows an unauthorized attacker to elevate privileges over an adjacent network.

AnalysisAI

Privilege escalation in Microsoft's Azure Monitor Agent (specifically the Metrics Extension) lets an unauthenticated attacker on an adjacent network gain elevated privileges by exploiting improper TLS certificate validation (CWE-295). Because the agent fails to properly verify the certificate of the endpoint it communicates with, an attacker positioned on the same broadcast/logical network segment can impersonate a trusted server and hijack the agent's privileged context, yielding high confidentiality, integrity, and availability impact. Microsoft rates it CVSS 8.8; there is currently no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Azure Monitor Agent (AMA) is Microsoft's unified telemetry collection agent that gathers metrics, logs, and performance data from Azure VMs, Arc-enabled servers, and other resources, forwarding them to Azure Monitor. The affected component per the CPE (cpe:2.3:a:microsoft:azure_monitor_agent_metrics_extension) is the Metrics Extension, which handles metric emission over network channels. The root cause is CWE-295 (Improper Certificate Validation): the agent does not correctly validate the X.509 certificate presented by the server/peer it connects to, meaning it will accept a certificate that is invalid, mismatched, self-signed, or attacker-controlled. This breaks the authenticity guarantee TLS is supposed to provide, enabling a man-in-the-middle actor to masquerade as the legitimate telemetry/control endpoint and inject data or commands that the privileged agent process trusts.

RemediationAI

Patch available per vendor advisory - apply the updated Azure Monitor Agent Metrics Extension released by Microsoft as tracked in the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47632); the exact fixed version is not stated in the provided data, so obtain it from that advisory. The AMA extension is typically auto-updated by the Azure platform, so verify that automatic extension upgrades are enabled and that agents have picked up the current build rather than assuming they are current. As a compensating control until patched, restrict and segment the network paths the agent uses - isolate management/telemetry traffic to trusted subnets, enforce network security group (NSG) rules limiting which hosts can occupy the same adjacent segment as monitored machines, and monitor for rogue devices or ARP/MITM activity on those segments; the trade-off is added network configuration overhead and potential disruption to legitimate telemetry flows if segmentation rules are too tight.