CVE-2026-26117

CWE-2884 documents4 sources
Severity
7.8HIGH
EPSS
0.1%
top 83.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Microsoft ARC Enabled Servers - Azure Connected Machine AgentMicrosoft ARC Enabled Servers Azure Connected Machine Agent
Timeline
PublishedMar 10

Description

Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-76jf-fgc3-37rx: Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges lo↗2026-03-10
▶
CVEList
Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability↗2026-03-10
▶

📋Vendor Advisories

1
Microsoft
Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability↗2026-03-10
▶
CVE-2026-26117 (HIGH CVSS 7.8) | Authentication bypass using an alte | cvebase.io