What is the CVSS score of CVE-2026-69555?

CVE-2026-69555 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.5%.

Which versions of Azure Arc are affected by CVE-2026-69555?

Microsoft Azure Arc faces a critical privilege escalation vulnerability (CVSS 10.0) allowing unauthenticated network attackers to gain elevated privileges across managed hybrid and multicloud…. A patch is available.

How to fix or mitigate CVE-2026-69555?

Within 24 hours, inventory all Azure Arc-connected resources and assess their criticality; isolate mission-critical workloads if feasible and review access logs for unauthorized privilege escalation attempts. Within 7 days, deploy Microsoft's released security patch to all Azure Arc agents, extension services, and management infrastructure, prioritizing production hybrid and multicloud systems. Within 30 days, complete patch verification across all Arc-managed resources, conduct post-remediation audit of elevated privilege usage to detect exploitation, and update your incident response runbooks for hybrid cloud incidents.

Azure Arc CVE-2026-69555

EUVD-2026-63627 CRITICAL

Incorrect Authorization (CWE-863)

2026-08-20 microsoft

GHSA-m9j2-qfhx-hm42

Authentication Bypass Microsoft Azure Arc

10.0

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

vuln.today AI

10.0 CRITICAL

Incorrect authorization is remotely reachable and unauthenticated (AV:N/PR:N/AC:L), grants privileges across a trust boundary (S:C) with high C/I impact but no availability effect (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 20, 2026 - 22:31 vuln.today

CVE Published

Aug 20, 2026 - 21:47 nvd

CRITICAL 10.0

DescriptionCVE.org

Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Azure Arc allows an unauthorized, network-based attacker to bypass authorization checks (CWE-863) and gain elevated privileges over managed hybrid/multicloud resources, with a maximal CVSS 3.1 score of 10.0 driven by a changed scope and high confidentiality/integrity impact. The flaw is reachable remotely without authentication or user interaction (AV:N/AC:L/PR:N/UI:N), and because scope is changed, exploitation can affect resources beyond the initially vulnerable component. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required - remote, unauthenticated, low-complexity exploitation against the Azure Arc service without user interaction. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	All primary severity signals point to top-tier priority: CVSS 3.1 base score is 10.0 with the worst-case vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H), meaning network-reachable, low-complexity, unauthenticated exploitation that crosses a trust/scope boundary with high confidentiality and integrity impact (availability impact is None). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Patch available per vendor advisory: apply the Microsoft fix referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69555. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all Azure Arc-connected resources and assess their criticality; isolate mission-critical workloads if feasible and review access logs for unauthorized privilege escalation attempts. …

Threat intelligence, references, and detailed analysis are available after sign-in.