7.0
High
CVE-2025-47989 Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally
Description
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Arc Enabled Servers - Azure Connected Machine Agent 1.0 | 1.0.0 → < 1.57 | 1.57 |
Other CVEs of Arc Enabled Servers - Azure Connected Machine Agent
The 4 CVEs of Arc Enabled Servers - Azure Connected Machine Agent →
CVE-2026-96204
Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network
6.5
Medium
CVE-2026-26117
Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized…
7.8
High
CVE-2025-58724
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally
7.8
High