7.8
High
CVE-2026-26117 Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized…
Description
Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Arc Enabled Servers - Azure Connected Machine Agent 1.0 | 1.0.0 → < 1.61 | 1.61 |
Other CVEs of Arc Enabled Servers - Azure Connected Machine Agent
The 4 CVEs of Arc Enabled Servers - Azure Connected Machine Agent →
CVE-2026-96204
Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network
6.5
Medium
CVE-2025-58724
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally
7.8
High
CVE-2025-47989
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally
7.0
High