CVE-2025-55316 Azure Connected Machine Agent Elevation of Privilege Vulnerability

...

Azure Connected Machine Agent Elevation of Privilege Vulnerability

External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally...

September 9, 2025—KB5065509 (Monthly Rollup)

None None...

September 9, 2025—KB5065507 (Monthly Rollup)

None None...

PT-2025-36895

Name of the Vulnerable Software and Affected Versions: Azure Arc affected versions not specified Description: The software contains a flaw related to external control of file name or path. This allows an authorized attacker to elevate privileges locally. Recommendations: At the moment, there is n...

July 8, 2025—KB5062597 (Monthly Rollup)

None None...

July 8, 2025—KB5062592 (Monthly Rollup)

None None...

August 12, 2025—Hotpatch KB5064010 (OS Build 26100.4851)

None None...

August 12, 2025—KB5063950 (Monthly Rollup)

None None...

June 10, 2025—KB5061018 (Monthly Rollup)

None None...

June 10, 2025—Hotpatch KB5060841 (OS Build 26100.4270)

None None...

May 13, 2025—KB5058451 (Monthly Rollup)

None None...

May 13, 2025—KB5058403 (Monthly Rollup)

None None...

April 8, 2025—KB5055581 (Monthly Rollup)

None None...

CVE-2025-26627

Improper neutralization of special elements used in a command 'command injection' in Azure Arc allows an authorized attacker to elevate privileges locally...

The vulnerability of the Azure Arc software for connecting local infrastructure lies in the lack of data cleansing measures at the management level, allowing attackers to escalate their privileges.

The vulnerability of the Azure Arc software installer for local infrastructure is related to the lack of data cleansing measures at the management level. Exploiting this vulnerability can allow attackers to enhance their privileges...

Vulnerabilities fixed in Microsoft Azure

Microsoft has fixed vulnerabilities in several Azure products. A malicious person could exploit the vulnerabilities to grant themselves elevated privileges or execute arbitrary code with the privileges of the vulnerable application. Azure PromptFlow:...

CVE-2025-26627

Improper neutralization of special elements used in a command 'command injection' in Azure Arc allows an authorized attacker to elevate privileges locally...

CVE-2025-26627

Improper neutralization of special elements used in a command 'command injection' in Azure Arc allows an authorized attacker to elevate privileges locally...

CVE-2025-26627 Azure Arc Installer Elevation of Privilege Vulnerability

...