What is the CVSS score of CVE-2026-62830?

CVE-2026-62830 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Azure SRE Agent are affected by CVE-2026-62830?

Microsoft Azure SRE Agent contains a critical privilege escalation vulnerability that allows authorized users to bypass security controls and gain elevated access to cloud infrastructure.

How to fix or mitigate CVE-2026-62830?

Within 24 hours: identify and inventory all Azure SRE Agent instances in production and non-production environments; determine which systems allow access from non-administrative users and assess exposure risk. Within 7 days: implement network-level access restrictions limiting Azure SRE Agent connectivity to trusted administrative networks; enable comprehensive audit logging of all privilege escalation attempts; enforce principle of least privilege on all service accounts interacting with the agent. Within 30 days: establish a patch management tracking process for CVE-2026-62830; upon vendor patch release, validate in isolated test environment within 48 hours and deploy to production systems within 72 hours of validation.

Azure SRE Agent CVE-2026-62830

EUVD-2026-54321 CRITICAL

Missing Authorization (CWE-862)

2026-08-07 secure@microsoft.com

GHSA-xqxc-x9r4-3vjh

Authentication Bypass Microsoft Azure Sre Agent

9.9

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

9.9 CRITICAL

Network-reachable agent operation, low complexity, requires an existing low-privilege identity (PR:L), no user interaction, and a missing-auth check that crosses trust boundaries (S:C) yielding full CIA impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 07, 2026 - 00:32 vuln.today

CVE Published

Aug 07, 2026 - 00:16 nvd

CRITICAL 9.9

DescriptionCVE.org

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation in Microsoft's Azure SRE Agent lets an already-authorized, low-privilege network actor gain higher privileges by exploiting a missing authorization check (CWE-862). Rated CVSS 9.9 with a scope change, the flaw means an attacker holding only limited access to the service can cross a trust boundary and reach resources or actions reserved for higher-privilege identities. No public exploit has been identified at time of analysis and it is not on the CISA KEV list, but the near-maximum score and cloud-service exposure make it a high-priority patch item.

Technical ContextAI

Azure SRE Agent is a Microsoft cloud/AI operations agent that performs site-reliability engineering tasks (incident triage, diagnostics, and automated remediation) against Azure resources, typically operating with elevated permissions over customer environments. The root cause is CWE-862 (Missing Authorization): a code path performs a sensitive operation without verifying that the calling identity is entitled to it. Because the agent brokers privileged operations on behalf of users, a missing server-side authorization check allows one authorization context to invoke actions belonging to another. The CVSS scope-change flag (S:C) indicates the vulnerable component can affect resources beyond its own security authority - consistent with a control-plane agent acting across tenant or role boundaries. No CPE strings were supplied, so exact affected component versions are not enumerable from the provided data; this is a Microsoft-hosted service, so versioning is service-side rather than a customer-installed build.

RemediationAI

Because Azure SRE Agent is a Microsoft-operated cloud service, the fix is delivered by the vendor and generally requires no customer-side package upgrade; consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62830 to confirm remediation status for your tenant, as no discrete customer patch version was published in the available data (Patch available per vendor advisory). As compensating controls until the service-side fix is confirmed, restrict which identities can access the SRE Agent by tightening Azure RBAC role assignments and Conditional Access so only necessary low-privilege principals retain access, review and prune the agent's own managed-identity permissions to the minimum scope (reducing blast radius of any escalation), and audit agent activity logs for anomalous privileged operations - with the trade-off that narrowing access may interrupt legitimate automated remediation workflows the agent performs.