CVE-2026-21224: Microsoft Azure Connected Machine Agent

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Stack-based buffer overflow in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.

Affected products

• Microsoft Azure Connected Machine Agent: before 1.60 (fixed in 1.60)

Published 2026-01-13. Last modified 2026-06-17.