EUVD-2026-99743
GHSA-hprm-w7jh-7cpv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege authorized access
-
DeliveryCraft request abusing agent SSRF
-
ExploitAgent fetches internal/metadata endpoint
-
ExecutionHarvest credentials or sensitive response
-
ImpactElevate privileges over network
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an already-authorized, low-privilege actor (CVSS PR:L) with network reach to the Azure Arc Connected Machine Agent, and affects Arc Enabled Servers running Azure Connected Machine Agent versions 1.0.0 up to but not including 1.68. The SSRF is the enabling primitive: the attacker must be able to supply or influence a request/URL that the agent then fetches on their behalf, directing it at an internal or cloud-metadata endpoint to obtain privilege-relevant data. Limiting factors: it is not remote-unauthenticated (an attacker with zero credentials cannot exploit it), no user interaction is required (UI:N), impact is confidentiality-only per CVSS (I:N/A:N), and patching to agent version 1.68 or later removes the exposure. |
| Impact | This is a moderate-priority issue, not a top-tier emergency, and the signals are largely consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring low-level privileges - meaning the attacker must already be an authenticated/authorized actor, which materially limits the exposed population. SSVC reinforces a lower urgency: Exploitation is 'none' (no observed activity), and Automatable is 'no', so this is unlikely to be mass-weaponized; however SSVC rates Technical Impact as 'total', which sits in tension with the CVSS impact profile of C:H/I:N/A:N (confidentiality-only). That tension is worth noting: SSVC's 'total' likely reflects the SSRF being leverageable to reach the instance metadata / credential endpoints and thereby escalate, whereas the CVSS vector only scores the direct confidentiality disclosure. There is no CISA KEV listing and no public POC indicated, so exploitation status is low. EPSS was not provided in the input and cannot be assessed. Net: a credible privilege-escalation vector for an already-authorized insider or a foothold-holding attacker, but the PR:L requirement and lack of known exploitation keep it below critical-patch-tonight severity for most environments. |
| Exploit ScenarioDerived | An attacker who already holds low-privilege access on or adjacent to an Azure Arc-enabled server with a vulnerable Connected Machine Agent (<1.68) sends a crafted request that the agent forwards to an internal/cloud endpoint it should not reach. By coercing the agent to request internal metadata or token endpoints, the attacker harvests credentials or responses that let them elevate privileges over the network. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Server-side request forgery in the Azure Arc Connected Machine Agent (versions 1.0.0 up to but not including 1.68) lets an already-authenticated, low-privilege actor induce the agent to fetch attacker-influenced URLs, reaching internal or cloud-metadata endpoints and returning data that can be used to elevate privileges over the network. The issue is confidentiality-only per the assessed vector (C:H/I:N/A:N) and requires network reach plus an existing low-privilege foothold - an unauthenticated attacker cannot exploit it - and no user interaction is needed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, and vendor patching to agent 1.68 or later removes the exposure.
RemediationAI
Upgrade the Azure Connected Machine Agent to version 1.68 or later on every Arc-enabled server - this is the vendor-released patch and fully removes the exposure; follow Microsoft's guidance in the update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96204 and verify the installed agent version after deployment, since Arc agents are typically updated automatically but can lag on disconnected or air-gapped hosts. Where immediate upgrade is not possible, apply compensating controls that target the SSRF primitive: restrict outbound network access from agent hosts so the agent cannot reach cloud instance metadata (169.254.169.254) or arbitrary internal endpoints unless explicitly required, accepting the trade-off that overly tight egress rules can break legitimate Arc connectivity and monitoring; segment agent hosts so a low-privilege local principal cannot reach services that would yield privilege-relevant data; and reduce the number of accounts that can trigger agent-initiated requests. Note that because exploitation requires PR:L, tightening local authorization and monitoring agent request logs for unexpected URL targets provides detection value, but none of these workarounds is a substitute for patching to 1.68.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic server-side request forgery (CWE-918) in the Azure Connected Machine Agent that powers Azure Arc-enabled servers. The agent is a privileged local service that communicates with Azure endpoints and, as part of its normal operation, performs outbound HTTP(S) requests on behalf of the host; the vulnerability means an authorized low-privilege actor can influence a request target so the agent fetches a URL of the attacker's choosing rather than a trusted destination. Because the agent typically runs with identity material and network placement that ordinary users do not have, a successful SSRF lets the attacker pivot into internal-only services or the cloud instance metadata service (IMDS) to retrieve tokens, configuration, or other privilege-relevant data, which is the enabling primitive for the assessed privilege escalation. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N confirms network attack vector, low complexity, prerequisites of an authenticated low-privilege principal (PR:L), no user interaction, unchanged scope, and a high-confidentiality-only impact; CISA's SSVC data rates exploitation as none, automation as no, and technical impact as total, meaning the data exposure could be significant if a suitable internal target exists but large-scale automated abuse is not expected.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
SSRF reachable over the network with low complexity but requires an authorized low-privilege actor (PR:L); impact is confidentiality disclosure of internal/credential data, so C:H and I:N/A:N.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Exploit-DB