Microsoft Azure Connected Machine Agent Privilege Escalation Vulnerability

A vulnerability allowing improper access control in the Azure Connected Machine Agent on Arc Enabled Servers has been identified. This flaw enables an authorized attacker to locally elevate privileges, potentially gaining SYSTEM rights.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing an attacker to gain SYSTEM privileges.

Remediation

Users can download the security update for this vulnerability from the Microsoft Update Catalog. Instructions for installing a specific version of the Azure Connected Machine Agent are also available on the Microsoft Learn website.