Azure Connected Machine Agent Elevation of Privilege Vulnerability

External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally...

September 9, 2025—KB5065507 (Monthly Rollup)

None None...

September 9, 2025—KB5065509 (Monthly Rollup)

None None...

CVE-2025-55316: External Control of File Name or Path

External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally...

PT-2025-36895

Name of the Vulnerable Software and Affected Versions: Azure Arc affected versions not specified Description: The software contains a flaw related to external control of file name or path. This allows an authorized attacker to elevate privileges locally. Recommendations: At the moment, there is n...

July 8, 2025—KB5062597 (Monthly Rollup)

None None...

July 8, 2025—KB5062592 (Monthly Rollup)

None None...

August 12, 2025—Hotpatch KB5064010 (OS Build 26100.4851) for Windows Server

None None...

August 12, 2025—KB5063950 (Monthly Rollup)

None None...

June 10, 2025—KB5061018 (Monthly Rollup)

None None...

June 10, 2025—Hotpatch KB5060841 (OS Build 26100.4270) for Windows Server

None None...

May 13, 2025—KB5058451 (Monthly Rollup)

None None...

May 13, 2025—KB5058403 (Monthly Rollup)

None None...

April 8, 2025—KB5055581 (Monthly Rollup)

None None...

CVE-2025-26627

Improper neutralization of special elements used in a command 'command injection' in Azure Arc allows an authorized attacker to elevate privileges locally...

The vulnerability of the Azure Arc software for connecting local infrastructure lies in the lack of data cleansing measures at the management level, allowing attackers to escalate their privileges.

The vulnerability of the Azure Arc software installer for local infrastructure is related to the lack of data cleansing measures at the management level. Exploiting this vulnerability can allow attackers to enhance their privileges...

Vulnerabilities fixed in Microsoft Azure

Microsoft has fixed vulnerabilities in several Azure products. A malicious person could exploit the vulnerabilities to grant themselves elevated privileges or execute arbitrary code with the privileges of the vulnerable application. Azure PromptFlow:...

CVE-2025-26627

Improper neutralization of special elements used in a command 'command injection' in Azure Arc allows an authorized attacker to elevate privileges locally...

CVE-2025-26627

Improper neutralization of special elements used in a command 'command injection' in Azure Arc allows an authorized attacker to elevate privileges locally...

CVE-2025-26627

CVE-2025-26627 affects Microsoft Azure Arc Installer. The issue is an improper neutralization of special elements in a command (command injection) that allows an authorized local attacker to elevate privileges. The root cause is described across sources as a command injection vulnerability in Azu...