CVE-2026-40381: Microsoft Azure Connected Machine Agent

High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days.

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.

Affected products

• Microsoft Azure Connected Machine Agent: before 1.63 (fixed in 1.63)

Published 2026-05-12. Last modified 2026-06-17.