Microsoft Azure Connected Machine Agent Privilege Escalation Vulnerability

A vulnerability allowing improper access control in Azure Connected Machine Agent has been identified, which could enable an authorized attacker to locally elevate privileges. This issue arises from the agent's failure to properly manage access controls, allowing unauthorized operations to be performed by users with standard privileges.

Impact

Exploitation of this vulnerability could allow an attacker to elevate privileges to the 'NT AUTHORITY\SYSTEM' user, enabling arbitrary code execution.

Remediation

Users are advised to update Azure Connected Machine Agent to the latest version. For more information, consult the Azure Connected Machine Agent Release Notes.