7.0
High
CVE-2025-26627 Improper neutralization of special elements used in a command ('command injection') in Azure Arc allows an authorized…
Description
Improper neutralization of special elements used in a command ('command injection') in Azure Arc allows an authorized attacker to elevate privileges locally.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Azure ARC 1.0 | 1.0.0 → < 1.0.10 | 1.0.10 |
References
- Azure Arc Installer Elevation of Privilege Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of Azure ARC
The 6 CVEs of Azure ARC →
CVE-2026-69399
Unintended proxy or intermediary in Azure Arc allows an authorized attacker to elevate privileges over a network
9.9
Critical
CVE-2026-70009
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized…
9.3
Critical
CVE-2026-69555
Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network
10.0
Critical
CVE-2026-24302
Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network
8.6
High