Search CVEs, research… / diras.sa
  • PATCH AVAILABLE

CVE-2026-69399: elevation of privilege in Microsoft Azure ARC

An unauthenticated remote attacker can gain elevated privileges in Microsoft Azure ARC, tracked as CVE-2026-69399. The flaw is classified under CWE-441 and has a CVSS 3.1 score of 9.8, indicating network access with no required privileges or user interaction can lead to full confidentiality, integrity, and availability impact. Microsoft lists the Azure ARC branch as affected; specific fixed versions are not included in the provided data. An attacker only needs network access to target exposed Azure ARC components.

Published Updated Source: CVE Program, NVD, FIRST EPSS, Vendor advisory

CVSS 3.1
9.8CRITICAL
EPSS
0.00484
CWE
CWE-441
KEV DUE DATE
Not listed
PATCH
Available

DIRAS TAKE

Treat this as urgent: the issue allows privilege elevation over the network with no authentication required and carries a critical CVSS 9.8 rating, so prioritize mitigations and vendor updates for internet-facing Azure ARC instances.

What is CVE-2026-69399?

An unauthenticated remote attacker can gain elevated privileges in Microsoft Azure ARC, tracked as CVE-2026-69399. The flaw is classified under CWE-441 and has a CVSS 3.1 score of 9.8, indicating network access with no required privileges or user interaction can lead to full confidentiality, integrity, and availability impact. Microsoft lists the Azure ARC branch as affected; specific fixed versions are not included in the provided data. An attacker only needs network access to target exposed Azure ARC components.

Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Which versions of Microsoft Azure ARC are affected?

BRANCHAFFECTEDFIXED
Azure ARC-

Is CVE-2026-69399 being exploited?

There are no public reports of exploitation as of 2026-09-29.

How to fix CVE-2026-69399

  1. Apply the vendor's security update for Azure ARC immediately if available.
  2. If a patch cannot be applied, restrict network exposure of Azure ARC services to trusted management networks.
  3. Monitor Azure ARC logs and alerting for unusual privilege changes and post-auth activities.
  4. Follow Microsoft's guidance for configuration hardening and remove unnecessary external access.

Frequently asked questions

Is CVE-2026-69399 being actively exploited?

There are no public reports of exploitation of CVE-2026-69399 as of 2026-09-29.

Which Azure ARC versions are affected by CVE-2026-69399?

The data indicates the Azure ARC branch is affected, but specific affected or fixed version numbers are not provided in the available facts.

Is there a patch for CVE-2026-69399?

A patch is reported as available in the provided facts; however, no fixed version identifiers were listed, so apply the vendor update referenced in Microsoft's advisory.

Does CVE-2026-69399 require authentication?

No authentication is required according to the vulnerability data: the issue can be triggered remotely without privileges or user interaction.

References