CVE-2025-26627 Azure Arc Installer Elevation of Privilege Vulnerability

...

CVE-2025-26627 Azure Arc Installer Elevation of Privilege Vulnerability

...

CVE-2025-26627

CVE-2025-26627 affects Microsoft Azure Arc Installer. The issue is an improper neutralization of special elements in a command (command injection) that allows an authorized local attacker to elevate privileges. The root cause is described across sources as a command injection vulnerability in Azu...

March 11, 2025—KB5053887 (Monthly Rollup)

None None...

March 11, 2025—KB5053886 (Monthly Rollup)

None None...

Azure Arc Installer Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Azure Arc allows an authorized attacker to elevate privileges locally...

PT-2025-10844

Name of the Vulnerable Software and Affected Versions: Azure Arc affected versions not specified Description: The issue is related to improper neutralization of special elements used in a command, also known as 'command injection', in Azure Arc. This allows an authorized attacker to elevate...

Microsoft Azure 命令注入漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from the U.S.-based Microsoft. An elevation of privilege vulnerability exists in Microsoft Azure Arc Installer, which can be exploited by an attacker to elevate privileges...

February 11, 2025—KB5052020 (Monthly Rollup)

None None...

February 11, 2025—KB5052042 (Monthly Rollup)

None None...

Security update 2025-02-11

...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: arc: fixed the device for dmamapsingle/dmaunmapsingle ndev-dev and pdev-dev are not the same device; use ndev-dev.parent, which has dmamask. ndev-dev.parent is simply pdev-dev. Otherwise, the following issue will occur:...

CVE-2024-21864

Improper neutralization in some IntelR ArcTM & IrisR Xe Graphics software before version 31.0.101.5081 may allow an unauthenticated user to potentially enable escalation of privilege via adjacent network access...

CVE-2024-31850

A path traversal vulnerability exists in the Java version of CData Arc 23.4.8839 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions...

January 14, 2025—KB5050004 (Monthly Rollup)

None None...

December 10, 2024—Hotpatch KB5048794 (OS Build 26100.2528)

None None...

December 10, 2024—KB5048699 (Monthly Rollup)

None None...

CVE-2024-50295

In the Linux kernel, the following vulnerability has been resolved: net: arc: fix the device for dmamapsingle/dmaunmapsingle The ndev-dev and pdev-dev aren't the same device, use ndev-dev.parent which has dmamask, ndev-dev.parent is just pdev-dev. Or it would cause the following issue: 39.933526...

DEBIAN-CVE-2024-50295

In the Linux kernel, the following vulnerability has been resolved: net: arc: fix the device for dmamapsingle/dmaunmapsingle The ndev-dev and pdev-dev aren't the same device, use ndev-dev.parent which has dmamask, ndev-dev.parent is just pdev-dev. Or it would cause the following issue: 39.933526...

CVE-2024-50295

In the Linux kernel, the following vulnerability has been resolved: net: arc: fix the device for dmamapsingle/dmaunmapsingle The ndev-dev and pdev-dev aren't the same device, use ndev-dev.parent which has dmamask, ndev-dev.parent is just pdev-dev. Or it would cause the following issue: 39.933526...