CVE-2025-62550
published 2025-12-09CVE-2025-62550: Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network.
PriorityP260high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.69%
48.3th percentile
Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | azure_monitor | >= 1.0.0 < 1.35.9 | 1.35.9 |
| microsoft | azure_monitor_agent | < 1.35.9 | 1.35.9 |
| msrc | azure_monitor_agent | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Look for exploitation attempts targeting Azure Monitor Agent on Azure Linux Virtual Machines via local network access — attacker exploits a heap overflow to escalate privileges to the syslog user and execute arbitrary commands. ↗
- →Any authenticated (low-privilege) user can trigger this vulnerability over the network — monitor for unexpected privilege escalation to the syslog user on Azure Linux VMs running Azure Monitor Agent. ↗
- →The vulnerability is an out-of-bounds write (heap overflow) in Azure Monitor Agent — monitor for anomalous memory corruption signals or crashes in the Azure Monitor Agent process on Linux VMs. ↗
- ·No public exploit exists as of the advisory date; exploitation is assessed as 'Less Likely' by Microsoft. Fixes were added December 11–12, 2025 for both Linux and Windows platforms — patch Azure Monitor Agent to the fixed version. ↗
- ·The attack vector requires local network access to the Azure Linux VM running Azure Monitor Agent — network segmentation limiting access to the agent's listening port reduces exposure. ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Azure Monitor Agent Remote Code Execution Vulnerability
vendor_msrc·2025-12-09·CVSS 8.8
CVE-2025-62550 [HIGH] CWE-787 Azure Monitor Agent Remote Code Execution Vulnerability
Azure Monitor Agent Remote Code Execution Vulnerability
Description: Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network.
FAQ: According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.
FAQ: How could an attacker exploit this vulnerability?
An attacker with local network access to an Azure Linux Virtual Machine running Azure Monitor could exploit a heap overflow to escalate privileges to the syslog user, enabling execution of arbitrary commands.
Azure Monitor Agent: Azure Monitor Agent
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Remote Code Execution
E
GHSA
GHSA-6jvc-gm78-f98r: Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network
ghsa_unreviewed·2025-12-09
CVE-2025-62550 [HIGH] CWE-131 GHSA-6jvc-gm78-f98r: Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network
Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network.
No detection rules found.
No public exploits indexed.
Bleepingcomputer
Microsoft December 2025 Patch Tuesday fixes 3 zero-days, 57 flaws
blogs_bleepingcomputer·2025-12-09·CVSS 7.8
[HIGH] Microsoft December 2025 Patch Tuesday fixes 3 zero-days, 57 flaws
## Microsoft December 2025 Patch Tuesday fixes 3 zero-days, 57 flaws
## Lawrence Abrams
28 Elevation of Privilege Vulnerabilities
19 Remote Code Execution Vulnerabilities
4 Information Disclosure Vulnerabilities
3 Denial of Service Vulnerabilities
2 Spoofing Vulnerabilities
When BleepingComputer reports on Patch Tuesday security updates, we only count those released by Microsoft today. Therefore, the number of flaws does not include Microsoft Edge (15 flaws) and Mariner vulnerabilities fixed earlier this month.
To learn more about the non-security updates released today, you can review our dedicated articles on the Windows 11 KB5072033 & KB5071417 cumulative updates .
If you're facing delays, blind spots, or prioritization issues with Patch Tuesday updates, our recent webinar with
Wiz
CVE-2025-62550 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.5
CVE-2025-62550 [HIGH] CVE-2025-62550 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-62550 :
Azure Monitor agent vulnerability analysis and mitigation
Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network.
Source : NVD
## 8.8
Score
Published December 9, 2025
Severity HIGH
CNA Score 8.8
Affected Technologies
Azure Monitor agent
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 28.2
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
cpe:2.3:a:microsoft:azure_monitor_agent
Sources
Linux Severity HIGH Has Fix Added at: Dec 11, 2025
Windows Severity HIGH Has Fix Added at: Dec 11, 2025
Linux Severity HIGH Has Fix Added at: Dec 12, 2025
Windows Severity HIGH Has Fix Added at: Dec 12, 2025
#
2025-12-09
Published