Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Azure Arc: Unauthenticated Users Can Escalate Privileges

CVE-2026-24302 · published 9 months ago
Summary

A security issue in Azure Arc could allow unauthenticated users to gain elevated access to sensitive systems and data. This means that attackers can potentially take control of systems and data without needing a password. To stay protected, ensure Azure Arc is kept up to date with the latest security patches and follow recommended configuration best practices.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft azure_arc All versions
cpe:2.3:a:microsoft:azure_arc:-:*:*:*:*:*:*:*
microsoft azure arc -
Original advisory text
Azure Arc Elevation of Privilege Vulnerability
Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published5 Feb 2026
Updated1 Nov 2026
First seen6 Mar 2026
Sources
CVE-2026-24302 · NVD
CVE-2026-24302 · MITRE
Track software like this
Free during beta