CVE-2026-26141: Microsoft Azure Automation Hybrid Worker Windows Extension

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Improper authentication in Azure Arc allows an authorized attacker to elevate privileges locally.

Affected products

• Microsoft Azure Automation Hybrid Worker Windows Extension: from 1.0.0, before 1.3.74 (fixed in 1.3.74)

Published 2026-03-10. Last modified 2026-06-17.