Azure Connected Machine Agent (Microsoft) - vulnerabilities (CVEs)

11 CVEs, 0 in the last 30 days, 69 known versions, newest CVE from 2026-07-14. Vendor: Microsoft.

CVEs of Azure Connected Machine Agent

• CVE-2026-47632 - CVSS 8.8 (high), 2026-07-14: Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network.
• CVE-2026-40381 - CVSS 7.8 (high), 2026-05-12: Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
• CVE-2026-21224 - CVSS 7.8 (high), 2026-01-13: Stack-based buffer overflow in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
• CVE-2025-58724 - CVSS 7.8 (high), 2025-10-14: Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
• CVE-2025-47989 - CVSS 7 (high), 2025-10-14: Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
• CVE-2025-55316 - CVSS 7.8 (high), 2025-09-09: External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally.
• CVE-2025-49692 - CVSS 7.8 (high), 2025-09-09: Improper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally.
• CVE-2024-38162 - CVSS 7.8 (high), 2024-08-13: Azure Connected Machine Agent Elevation of Privilege Vulnerability
• CVE-2024-38098 - CVSS 7.8 (high), 2024-08-13: Azure Connected Machine Agent Elevation of Privilege Vulnerability
• CVE-2024-21329 - CVSS 7.3 (high), 2024-02-13: Azure Connected Machine Agent Elevation of Privilege Vulnerability
• CVE-2023-35624 - CVSS 7.3 (high), 2023-12-12: Azure Connected Machine Agent Elevation of Privilege Vulnerability