Azure Arc
by Microsoft
CVEs (11)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-69399 | Cri | 0.65 | 10.0 | 0.00 | Sep 17, 2026 | Azure Arc Elevation of Privilege Vulnerability | ||
| CVE-2026-69555 | Cri | 0.65 | 10.0 | 0.01 | Aug 20, 2026 | Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network. | ||
| CVE-2026-65816 | Cri | 0.65 | 10.0 | 0.01 | Aug 20, 2026 | Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network. | ||
| CVE-2026-70009 | Cri | 0.61 | 9.3 | 0.01 | Sep 17, 2026 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network. | ||
| CVE-2026-62895 | Hig | 0.57 | 8.8 | 0.01 | Sep 8, 2026 | Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network. | ||
| CVE-2026-24302 | Hig | 0.56 | 8.6 | 0.02 | Feb 5, 2026 | Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network. | ||
| CVE-2026-26141 | Hig | 0.51 | 7.8 | 0.00 | Mar 10, 2026 | Improper authentication in Azure Arc allows an authorized attacker to elevate privileges locally. | ||
| CVE-2025-55316 | Hig | 0.51 | 7.8 | 0.00 | Sep 9, 2025 | External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally. | ||
| CVE-2022-38007 | Hig | 0.51 | 7.8 | 0.01 | Sep 13, 2022 | Azure Guest Configuration and Azure Arc-enabled servers Elevation of Privilege Vulnerability | ||
| CVE-2025-26627 | Hig | 0.46 | 7.0 | 0.01 | Mar 11, 2025 | Improper neutralization of special elements used in a command ('command injection') in Azure Arc allows an authorized attacker to elevate privileges locally. | ||
| CVE-2019-0804 | Med | 0.43 | 6.5 | 0.05 | Apr 9, 2019 | An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka 'Azure Linux Agent Information Disclosure Vulnerability'. |
- risk 0.65cvss 10.0epss 0.00
Azure Arc Elevation of Privilege Vulnerability
- risk 0.65cvss 10.0epss 0.01
Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- risk 0.65cvss 10.0epss 0.01
Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- risk 0.61cvss 9.3epss 0.01
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- risk 0.57cvss 8.8epss 0.01
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- risk 0.56cvss 8.6epss 0.02
Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- risk 0.51cvss 7.8epss 0.00
Improper authentication in Azure Arc allows an authorized attacker to elevate privileges locally.
- risk 0.51cvss 7.8epss 0.00
External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally.
- risk 0.51cvss 7.8epss 0.01
Azure Guest Configuration and Azure Arc-enabled servers Elevation of Privilege Vulnerability
- risk 0.46cvss 7.0epss 0.01
Improper neutralization of special elements used in a command ('command injection') in Azure Arc allows an authorized attacker to elevate privileges locally.
- risk 0.43cvss 6.5epss 0.05
An information disclosure vulnerability exists in the way Azure WaLinuxAgent creates swap files on resource disks, aka 'Azure Linux Agent Information Disclosure Vulnerability'.