Azure Arc EUVD-2026-63627

Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required - remote, unauthenticated, low-complexity exploitation against the Azure Arc service without user interaction. The specific prerequisite is network reachability to the vulnerable Azure Arc authorization endpoint/control plane; the limiting factor is therefore primarily network exposure of that management surface. Because scope is changed (S:C), a successful bypass affects resources beyond the directly attacked component. The description does not name a specific feature toggle or non-default configuration as a precondition, so exploitation appears to apply to the service as deployed; the exact affected Arc component should be confirmed against the MSRC advisory.

All primary severity signals point to top-tier priority: CVSS 3.1 base score is 10.0 with the worst-case vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H), meaning network-reachable, low-complexity, unauthenticated exploitation that crosses a trust/scope boundary with high confidentiality and integrity impact (availability impact is None). Tempering signals: EPSS is not provided, the vulnerability is NOT in CISA KEV (no confirmed active exploitation), and no public POC is indicated - so this is a critical-by-design but not yet publicly-weaponized issue. SSVC/automatable data is not supplied and cannot be asserted. The lack of an availability impact (A:N) and the absence of KEV/EPSS data are the only factors that soften an otherwise maximal-risk profile; given a perfect CVSS and a Microsoft-issued fix, this should be treated as a high-priority remediation. Note the affected-version data is vague ('Azure ARC -'), consistent with a centrally-hosted cloud service rather than customer-versioned software - verify remediation status via the MSRC advisory rather than a local version number.

A remote attacker with network access to the Azure Arc management surface sends crafted requests that exploit the incorrect authorization check, causing the service to grant them privileges over Arc-managed resources they should not control. Because no authentication or user interaction is required and scope is changed, the attacker can pivot to read or modify configuration across enrolled hybrid resources. No public POC is identified at time of analysis, so exploitation would currently require independent vulnerability research.