Microsoft Azure Arc CVE-2026-69399

Exploitation requires low-privilege authenticated access to an Azure Arc context (PR:L in the vendor vector), performed remotely over the network with no user interaction (AV:N/UI:N). The specific Arc feature, API, or configuration that triggers the confused-deputy condition (CWE-441) is not described in the available sources, so the exact prerequisite setting cannot be named from the provided data. Limiting factors: an attacker must already possess some valid low-level Arc/Azure identity (it is not fully unauthenticated), and the scope change (S:C) implies the impact crosses the Arc management trust boundary into connected resources rather than staying local. No non-default configuration is documented as required, but absence of detail means this cannot be confirmed.

Signals conflict sharply and must be weighed, not averaged. Microsoft's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) describes a network-reachable, low-complexity flaw needing only low privileges, no user interaction, with a scope change and total confidentiality/integrity/availability impact - consistent with the 'Technical Impact: total' and 'Automatable: yes' entries in the SSVC record. The vuln.today decision label is 'act_now,' which aligns with that high severity and automatability. However, the real-world exploitation signals are much softer: SSVC 'Exploitation: none,' no CISA KEV listing, and no PoC or exploit reference in the provided sources, so this is NOT confirmed as actively exploited. EPSS is only 0.49% (41st percentile), i.e. low predicted 30-day exploitation probability, which contrasts with the 9.9 base score and 'act_now' label - a classic 'high-severity, not-yet-exploited' profile. The practical reading: this is a high-priority patch candidate because impact is total, the flaw is automatable, and privileges required are low, but there is currently no evidence of exploitation in the wild, so the urgency derives from potential blast radius (scope change across the Azure Arc hybrid-management trust boundary) rather than observed attacks. The description is a single stock title with no mechanism detail, so the exact trigger is not described in the available sources and the CVSS metrics should be treated as vendor-asserted, not independently reproducible.

An attacker holding only low-privilege authenticated access within an Azure Arc-managed environment abuses a confused-deputy condition (CWE-441) to have the Arc control plane act on its behalf across a trust boundary, gaining elevated control over connected resources. Because the CVSS vector is AV:N/AC:L/PR:L/UI:N with a scope change, the action is remote, low-complexity, needs no victim interaction, and reaches resources beyond the attacker's original authorization. No public exploit has been identified at time of analysis, and the exact trigger is not described in the available sources.