CVE-2026-26117

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-26117
Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26117 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:microsoft:arc_enabled_servers_azure_connected_machine_agent:*:*:*:*:*:*:*:*
History

13 Mar 2026, 20:14

Type Values Removed Values Added
CPE cpe:2.3:a:microsoft:arc_enabled_servers_azure_connected_machine_agent:*:*:*:*:*:*:*:*
First Time Microsoft arc Enabled Servers Azure Connected Machine Agent
Microsoft
CWE NVD-CWE-Other
Summary
  • (es) Omisión de autenticación utilizando una ruta o canal alternativo en el Agente de Máquina Virtual de Azure Windows permite a un atacante autorizado elevar privilegios localmente.
References () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26117 - () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26117 - Vendor Advisory

10 Mar 2026, 18:18

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 18:18

Updated : 2026-03-13 20:14

NVD link : CVE-2026-26117

Mitre link : CVE-2026-26117

CVE.ORG link : CVE-2026-26117

JSON object : View

Products Affected

microsoft

  • arc_enabled_servers_azure_connected_machine_agent
CWE
CWE-288

Authentication Bypass Using an Alternate Path or Channel

NVD-CWE-Other