Microsoft Azure Connected Machine Agent vulnerabilities

11 CVEs affecting Microsoft Azure Connected Machine Agent, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-47632, published 2026-07-14.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-21329, published 2024-02-13. High severity, CVSS 7.3. EPSS: 1.1% chance of exploitation in the next 30 days. Azure Connected Machine Agent Elevation of Privilege Vulnerability
• CVE-2023-35624, published 2023-12-12. High severity, CVSS 7.3. EPSS: 0.9% chance of exploitation in the next 30 days. Azure Connected Machine Agent Elevation of Privilege Vulnerability
• CVE-2024-38098, published 2024-08-13. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. Azure Connected Machine Agent Elevation of Privilege Vulnerability
• CVE-2025-58724, published 2025-10-14. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
• CVE-2025-47989, published 2025-10-14. High severity, CVSS 7.0. EPSS: 0.6% chance of exploitation in the next 30 days. Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
• CVE-2024-38162, published 2024-08-13. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Azure Connected Machine Agent Elevation of Privilege Vulnerability
• CVE-2026-47632, published 2026-07-14. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network.
• CVE-2025-55316, published 2025-09-09. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally.
• CVE-2025-49692, published 2025-09-09. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Improper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally.
• CVE-2026-21224, published 2026-01-13. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Stack-based buffer overflow in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.

Latest

• CVE-2026-40381, published 2026-05-12. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.