CVE-2026-26117

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

VendorProductVersions
MicrosoftArc Enabled Servers - Azure Connected Machine Agent>= 1.0.0, < 1.61

References

Timeline

Published
Mar 10, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-261188.8Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.CVE-2026-261198.8Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.CVE-2026-261207.5Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to perform tampering over a network.CVE-2026-261217.5Server-side request forgery (ssrf) in Azure IoT Explorer allows an unauthorized attacker to perform spoofing over a network.CVE-2026-261226.5Initialization of a resource with an insecure default in Azure Compute Gallery allows an authorized attacker to disclose information over a CVE-2026-261235.5Cwe is not in rca categories in Microsoft Authenticator allows an unauthorized attacker to disclose information locally.CVE-2026-261246.7'.../...//' in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.CVE-2026-261259.8Payment Orchestrator Service Elevation of Privilege VulnerabilityCVE-2026-261277.5Out-of-bounds read in .NET allows an unauthorized attacker to deny service over a network.CVE-2026-261287.8Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.CVE-2026-261297.5Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclCVE-2026-26138.7The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statemen
CVE-2026-26117: High severity, CVSS 7.8 | Vulnix