Security Updates for Azure Connected Machine Agent < 1.68 (October 2026)

The Microsoft Azure Connected Machine Agent installation on the remote host is missing security updates. It is, therefore, affected by an elevation of privilege vulnerability: - Server-side request forgery ssrf in Azure Arc allows an authorized attacker to elevate privileges over a network...

CVE-2026-47632

Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network...

CVE-2026-47632: Improper Certificate Validation

Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network...

Security Updates for Azure Connected Machine Agent < 1.63 (May 2026)

The Microsoft Azure Connected Machine Agent installation on the remote host is missing security updates. It is, therefore, affected by an elevation of privilege vulnerability: - Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally...

EUVD-2026-29657

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally...

CVE-2026-40381 Azure Connected Machine Agent Elevation of Privilege Vulnerability

...

CVE-2026-40381

CVE-2026-40381: Improper access control in the Azure Connected Machine Agent enables a locally authenticated attacker to elevate privileges. The vulnerability affects the Azure Connected Machine Agent; attacker must have local access and low privileges, with no user interaction required. The CVSS...

Microsoft Azure Connected Machine Agent Access Control Vulnerability

Microsoft Azure Connected Machine Agent is a core component of Microsoft that connects non-Azure servers to the Azure console. There is an access control vulnerability present in Microsoft Azure Connected Machine Agent. Attackers can exploit this vulnerability to gain higher privileges...

CVE-2026-40381: Improper Access Control

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally...

Azure Connected Machine Agent Auth Bypass

The vulnerability of the Azure Connected Machine Agent, a software tool for managing servers and virtual machines, relates to bypassing authentication by using an alternative path or channel. Exploiting this vulnerability can allow attackers to enhance their privileges...

EUVD-2026-10688

Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally...

CVE-2026-26117

Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally...

CVE-2026-26117

CVE-2026-26117 concerns Arc Enabled Servers running the Azure Connected Machine Agent. The vulnerability is an Elevation of Privilege issue affecting the Azure Arc-enabled machine agent on Arc-enabled servers. According to the CVSS data, it is a local, low-complexity attack requiring LOW privileg...

CVE-2026-26117

Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally...

PT-2026-24327

Name of the Vulnerable Software and Affected Versions Azure Windows Virtual Machine Agent affected versions not specified Azure Arc on Windows affected versions not specified Description A security issue exists in Azure Windows Virtual Machine Agent and Azure Arc on Windows that allows an attacke...

CVE-2026-26117: Authentication Bypass Using an Alternate Path or Channel

Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally...

Microsoft Azure Connected Machine Agent security vulnerabilities

Microsoft Azure Connected Machine Agent is a core component of Microsoft that connects non-Azure servers to the Azure console. There is a security vulnerability present in Microsoft Azure Connected Machine Agent. Attackers can exploit this vulnerability to gain higher privileges...

February 10, 2026—KB5075971 (Monthly Rollup)

None None...

CVE-2026-21224

Stack-based buffer overflow in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally...

Security Updates for Azure Connected Machine Agent < 1.60 (January 2026)

The Microsoft Azure Connected Machine Agent installation on the remote host is missing security updates. It is, therefore, affected by an elevation of privilege vulnerability CVE-2026-21224. - Successful exploitation of this vulnerability could allow a local attacker to gain SYSTEM privileges on...