Azure Sre Agent
Monthly
Privilege elevation in Microsoft's Azure SRE Agent lets an already-authorized, low-privilege network actor gain higher privileges by exploiting a missing authorization check (CWE-862). Rated CVSS 9.9 with a scope change, the flaw means an attacker holding only limited access to the service can cross a trust boundary and reach resources or actions reserved for higher-privilege identities. No public exploit has been identified at time of analysis and it is not on the CISA KEV list, but the near-maximum score and cloud-service exposure make it a high-priority patch item.
Information disclosure in Azure SRE Agent can be exploited by remote unauthenticated attackers via improper authentication mechanisms. The vulnerability carries an 8.6 CVSS score with network attack vector requiring low complexity and no user interaction, enabling attackers to extract high-confidentiality data with scope change impact. No public exploit identified at time of analysis, though the authentication bypass nature and network accessibility present significant risk to Azure infrastructure components.
Privilege elevation in Microsoft's Azure SRE Agent lets an already-authorized, low-privilege network actor gain higher privileges by exploiting a missing authorization check (CWE-862). Rated CVSS 9.9 with a scope change, the flaw means an attacker holding only limited access to the service can cross a trust boundary and reach resources or actions reserved for higher-privilege identities. No public exploit has been identified at time of analysis and it is not on the CISA KEV list, but the near-maximum score and cloud-service exposure make it a high-priority patch item.
Information disclosure in Azure SRE Agent can be exploited by remote unauthenticated attackers via improper authentication mechanisms. The vulnerability carries an 8.6 CVSS score with network attack vector requiring low complexity and no user interaction, enabling attackers to extract high-confidentiality data with scope change impact. No public exploit identified at time of analysis, though the authentication bypass nature and network accessibility present significant risk to Azure infrastructure components.