Microsoft Azure Arc vulnerabilities

6 CVEs affecting Microsoft Azure Arc, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-70009, published 2026-09-17.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-24302, published 2026-02-05. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
• CVE-2025-26627, published 2025-03-11. High severity, CVSS 7.0. EPSS: 0.9% chance of exploitation in the next 30 days. Improper neutralization of special elements used in a command ('command injection') in Azure Arc allows an authorized attacker to elevate privileges locally.
• CVE-2026-69555, published 2026-08-20. Critical severity, CVSS 10.0. EPSS: 0.8% chance of exploitation in the next 30 days. Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
• CVE-2022-38007, published 2022-09-13. High severity, CVSS 7.8. EPSS: 0.7% chance of exploitation in the next 30 days. Azure Guest Configuration and Azure Arc-enabled servers Elevation of Privilege Vulnerability
• CVE-2026-70009, published 2026-09-17. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-69399, published 2026-09-17. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Azure Arc Elevation of Privilege Vulnerability