Azure Arc (Microsoft) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 12 known versions, newest CVE from 2026-09-17. Vendor: Microsoft.

CVEs of Azure Arc

• CVE-2026-69399 - CVSS 10 (critical), 2026-09-17: Azure Arc Elevation of Privilege Vulnerability
• CVE-2026-70009 - CVSS 9.8 (critical), 2026-09-17: Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a…
• CVE-2026-69555 - CVSS 10 (critical), 2026-08-20: Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-24302 - CVSS 9.8 (critical), 2026-02-05: Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
• CVE-2025-26627 - CVSS 7 (high), 2025-03-11: Improper neutralization of special elements used in a command ('command injection') in Azure Arc allows an authorized attacker to elevate privileges locally.
• CVE-2022-38007 - CVSS 7.8 (high), 2022-09-13: Azure Guest Configuration and Azure Arc-enabled servers Elevation of Privilege Vulnerability