EUVD-2026-82583
GHSA-9j4f-9vq9-m3f6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Azure Arc network endpoint
-
ExploitSend request with path-traversal sequences
-
ExecutionEscape restricted directory to privileged resource
-
ImpactElevate privileges over the network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) this is described as remote, unauthenticated, low-complexity privilege elevation against Azure Arc with no required user interaction. However, the MSRC advisory names no specific feature, protocol, endpoint, or configuration mode, and gives no affected versions, so the precise prerequisite (which Arc component or agent must be exposed) cannot be extracted from available data. A key limiting factor is that Azure Arc is a Microsoft-operated cloud/hybrid management service likely remediated server-side, and CISA SSVC rates the technical impact as only 'partial', suggesting realistic impact may be narrower than the CVSS 'total' rating implies. |
| Impact | This is a Microsoft-reported (secure@microsoft.com) path traversal (CWE-22) in Azure Arc rated 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, implying remote, unauthenticated, low-complexity privilege elevation with total impact. The signals conflict, however: CISA SSVC records Exploitation as 'none', Automatable 'yes', but Technical Impact only 'partial' - which sits in tension with the CVSS full C:H/I:H/A:H (total) rating, suggesting the real impact may be narrower than the headline score. EPSS is low at 0.47% (40th percentile), there is no CISA KEV listing, and no public exploit code was identified, so despite the critical CVSS this is not evidence of imminent or widespread exploitation. Because Azure Arc is a Microsoft-operated hybrid/multicloud management plane, any fix is almost certainly deployed server-side by Microsoft rather than requiring customer patching, which materially lowers real-world exposure for tenants. The MSRC advisory is a single vague one-liner with no affected build numbers or technical detail, so the concrete attack surface, the exact 'privilege' being elevated, and whether pre-auth reachability is truly the case cannot be independently verified - treat the 9.8 as vendor/NVD-asserted rather than confirmed by reproducible detail. |
| Exploit ScenarioDerived | A remote attacker sends crafted requests containing traversal sequences to an Azure Arc network endpoint, escaping the intended restricted directory to reach or manipulate privileged resources and thereby elevate privileges. No user interaction or authentication is indicated by the CVSS vector, but no public proof-of-concept exists and there is no evidence of exploitation in the wild. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 25, 2026
Path traversal (CWE-22) in Microsoft Azure Arc, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), could allow a remote, unauthenticated attacker to elevate privileges and read or write files outside an intended restricted directory, with high confidentiality, integrity, and availability impact if fully realized. Microsoft's own advisory (secure@microsoft.com) provides no affected version details, no named component, protocol, or endpoint, so the specific exposure prerequisite is not confirmed from available data; CISA SSVC likewise rates exploitation as 'none' and technical impact as only 'partial', suggesting realistic impact is likely narrower than the raw score implies. EPSS is low at 0.47% (40th percentile) and no public exploit code has been identified at time of analysis, so near-term exploitation risk appears limited even though the flaw is remotely automatable.
Earlier versions of this analysis (1)
Path traversal (CWE-22) in Azure Arc allows a remote, unauthenticated attacker to break out of an intended restricted directory and elevate privileges, per the vendor CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N (base 9.3). The scope change (S:C) means the impact crosses into a separately managed security authority, with high integrity impact and low confidentiality impact while availability is unaffected. No confirmed active exploitation (CISA KEV) and no publicly available exploit code were identified at time of analysis, and the supplied intelligence contains only the Microsoft MSRC advisory, so the specific affected Azure Arc component and its network exposure must still be confirmed by defenders.
RemediationAI
Microsoft published a vendor advisory through the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70009; patch availability is confirmed per vendor advisory, but no exact fixed version or build number is present in the provided data, so administrators should retrieve the precise remediation from that advisory rather than assume a version. Because Azure Arc is largely a Microsoft-operated service, remediation for any service-side component is expected to be applied automatically without customer action, and customers should verify current agent versions in the Azure portal and apply the latest Azure Connected Machine agent release where an agent-side fix is indicated. If an immediate update is not possible, compensating controls with real trade-offs include restricting network reachability to Arc agent and Arc service endpoints so only trusted management networks can initiate connections (side effect: this can break onboarding, extension deployment, and monitoring until connectivity is restored), enforcing strict egress proxy allow-listing to Microsoft Arc endpoints to narrow the traversal attack surface (side effect: overly tight filtering causes agent degradation or disconnection), and reducing privileges of the account running the Arc agent so a traversal escape yields less (side effect: insufficient permissions can prevent legitimate extension and guest-configuration operations). Given SSVC exploitation status of 'none' and a low EPSS of 0.47%, aggressive emergency isolation is not warranted; prioritize confirming scope from the MSRC advisory, updating the agent, and monitoring agent logs for anomalous path or traversal patterns.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-22, improper limitation of a pathname to a restricted directory, a classic traversal pattern where user-supplied or externally influenced path input is resolved without sufficient normalization, canonicalization, or confinement to a base directory, allowing sequences such as '../' (or encoded/alternate-separator equivalents) to escape the intended scope. Azure Arc is Microsoft's hybrid and multicloud management control plane for Azure Arc-enabled servers, Kubernetes clusters, and data services; its on-host Connected Machine agent and associated service endpoints handle configuration, extension deployment, and guest-management traffic, which is the type of component where path handling is typically implemented. The CPE string cpe:2.3:a:microsoft:azure_arc:-:*:*:*:*:*:*:* carries no version qualifier, and the EUVD affected-version entry is likewise a bare 'Azure ARC -', so the data does not identify which Arc component (agent, extension, or service-side API) contains the flawed pathname handling, nor which configuration mode exposes it. Because Azure Arc is substantially a Microsoft-operated cloud service, a portion of the fix surface is likely server-side and transparent to customers, while any agent-side component would require customer-initiated updates.
Know when Azure Arc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Description states unauthorized network privilege elevation (AV:N/PR:N/AC:L), so I retain the NVD vector, though SSVC 'partial' impact hints the C:H/I:H/A:H totals may be overstated.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
Executive ViewAI
Microsoft Azure Arc, the control plane used to govern on-premises, edge, and multi-cloud servers and Kubernetes clusters, is affected by a critical path-traversal weakness (CVE-2026-70009) that a remote, unauthenticated attacker could leverage to read or write files outside intended directories on managed resources. Because Arc agents and connected-machine identities frequently carry broad, estate-wide privileges, a successful attack could undermine the confidentiality and integrity of hybrid-cloud operations rather than a single workload. Leadership should note that no public exploit has been identified, CISA SSVC rates exploitation as 'none', and Microsoft's advisory names no affected versions or fix, so the immediate risk is constrained but the exposure is unpatched and must be actively managed.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict Arc endpoints and agents to trusted management networks via segmentation and firewall rules; enforce least privilege on Arc service identities and remove unnecessary write permissions to managed resources; enable verbose logging and monitor for anomalous path traversal file access; limit or disable internet-facing Arc management interfaces where operationally feasible; and validate filesystem boundaries on managed hosts pending vendor guidance.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Privilege escalation in Microsoft Azure Arc allows an unauthorized, network-based attacker to bypass authorization check
Azure Arc's confused-deputy flaw (CWE-441) allows a low-privileged, authenticated remote actor to cross the service's ma
Azure Guest Configuration and Azure Arc-enabled servers Elevation of Privilege Vulnerability. Rated high severity (CVSS
Exploit-DB