7.8
High
CVE-2026-40381 Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally
Description
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Azure Connected Machine Agent 1.0 | 1.0.0 → < 1.63 | 1.63 |
References
- Azure Connected Machine Agent Elevation of Privilege Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of Azure Connected Machine Agent
The 9 CVEs of Azure Connected Machine Agent →
CVE-2026-47632
Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges…
8.8
High
CVE-2026-21224
Stack-based buffer overflow in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally
7.8
High
CVE-2025-49692
Improper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges…
7.8
High
CVE-2025-55316
External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally
7.8
High