EUVD-2026-22573
GHSA-h54c-4c22-cqmp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation in Azure Monitor Agent versions prior to 1.41.0 exploits insecure deserialization of untrusted data, allowing authenticated local attackers with low privileges to achieve full system compromise (high confidentiality, integrity, and availability impact). CVSS 7.8 severity reflects local attack vector with low complexity and no user interaction required. No public exploit identified at time of analysis, though the vulnerability class (CWE-502) is well-understood and frequently targeted. Microsoft has released patch version 1.41.0 to address this flaw.
Technical ContextAI
The vulnerability resides in the Azure Monitor Agent (cpe:2.3:a:microsoft:azure_monitor), a cross-platform telemetry collection service deployed on Azure VMs and hybrid infrastructure. The flaw stems from CWE-502 (Deserialization of Untrusted Data), where the agent processes serialized objects without proper validation or sanitization. Insecure deserialization allows attackers to craft malicious serialized payloads that, when processed by the agent, execute arbitrary code with the agent's elevated privileges. Azure Monitor Agent typically runs with SYSTEM-level or root permissions to collect performance metrics, logs, and security telemetry, making it a high-value target for privilege escalation. The deserialization vulnerability likely affects data ingestion pipelines or inter-process communication mechanisms within the agent that accept external input without cryptographic integrity checks or type constraints.
RemediationAI
Upgrade Azure Monitor Agent to version 1.41.0 or later, which contains fixes for the insecure deserialization vulnerability. Microsoft recommends deploying updates through Azure Update Management, Azure Arc extension management, or manual agent package installation depending on deployment model. For Windows environments, use the MSI installer from Microsoft Download Center; for Linux, update via distribution package managers or direct RPM/DEB installation. Verify successful patch deployment by confirming agent version 1.41.0 or higher through Azure portal monitoring blade or local agent version queries. Organizations unable to immediately patch should implement compensatory controls including restricting local user permissions, enabling SELinux or AppArmor policies to constrain agent process capabilities, monitoring for suspicious deserialization-related process execution patterns, and isolating Azure Monitor Agent network communication. Complete remediation guidance available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32192.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today