CVE-2025-58724

CWE-284 — Improper Access Control4 documents4 sources
Severity
7.8HIGH
EPSS
0.1%
top 82.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Microsoft ARC Enabled Servers - Azure Connected Machine AgentMicrosoft Azure Connected Machine Agent
Timeline
PublishedOct 14

Description

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-h3w8-46xj-f555: Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally↗2025-10-14
▶
CVEList
Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability↗2025-10-14
▶

📋Vendor Advisories

1
Microsoft
Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability↗2025-10-14
▶
CVE-2025-58724 (HIGH CVSS 7.8) | Improper access control in Azure Co | cvebase.io