Azure Connected Machine Agent
Monthly
Local privilege escalation in Microsoft's Azure Connected Machine Agent (versions 1.0.0 through 1.62) allows a low-privileged authenticated user on an Azure Arc-enabled machine to gain SYSTEM-level privileges by abusing an improper access control weakness. Microsoft has released a fixed build (1.63) and this is currently classified with no known exploitation (SSVC: none), consistent with an EPSS score of just 0.04%; no public exploit identified at time of analysis. The flaw is tagged as an authentication bypass and carries full technical impact (total) across confidentiality, integrity, and availability.
Local privilege escalation in Azure Connected Machine Agent exploits a stack-based buffer overflow, enabling authenticated users to gain elevated system privileges. The vulnerability affects Azure and Stack Overflow deployments and requires local access with valid credentials to exploit. No patch is currently available for this high-severity issue.
External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Azure Connected Machine Agent Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Azure Connected Machine Agent Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Azure Connected Machine Agent Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.
Azure Connected Machine Agent Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.
Local privilege escalation in Microsoft's Azure Connected Machine Agent (versions 1.0.0 through 1.62) allows a low-privileged authenticated user on an Azure Arc-enabled machine to gain SYSTEM-level privileges by abusing an improper access control weakness. Microsoft has released a fixed build (1.63) and this is currently classified with no known exploitation (SSVC: none), consistent with an EPSS score of just 0.04%; no public exploit identified at time of analysis. The flaw is tagged as an authentication bypass and carries full technical impact (total) across confidentiality, integrity, and availability.
Local privilege escalation in Azure Connected Machine Agent exploits a stack-based buffer overflow, enabling authenticated users to gain elevated system privileges. The vulnerability affects Azure and Stack Overflow deployments and requires local access with valid credentials to exploit. No patch is currently available for this high-severity issue.
External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
Azure Connected Machine Agent Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Azure Connected Machine Agent Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Azure Connected Machine Agent Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.
Azure Connected Machine Agent Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.