CVE-2026-96204 Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network

Description

Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.

Affected products and versions

Product	Affected versions	Fixed in
Arc Enabled Servers - Azure Connected Machine Agent 1.0	1.0.0 → < 1.68	1.68

Other CVEs of Arc Enabled Servers - Azure Connected Machine Agent

The 4 CVEs of Arc Enabled Servers - Azure Connected Machine Agent →

CVE-2026-26117 Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized… 7.8 High CVE-2025-58724 Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally 7.8 High CVE-2025-47989 Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally 7.0 High