CVE-2026-42830 is a CWE-426 untrusted search path vulnerability in the Azure Monitor Agent Metrics Extension (version 1.0.0). It allows an attacker with local authorized access to escalate privileges by manipulating the search path used by the agent to load components. The vulnerability has a CVSS v3.1 score of 6.5 (medium severity) with an attack vector of local, low complexity, and requires low privileges. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

An authorized local attacker can exploit this vulnerability to elevate their privileges on the affected system. There is no impact on confidentiality or availability, but integrity can be compromised due to privilege escalation. No known exploits are currently reported in the wild.

Microsoft has released an official fix for this vulnerability. As this is a cloud-hosted service, Microsoft manages the remediation server-side. Users should refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42830 for detailed guidance and ensure their Azure Monitor Agent Metrics Extension is updated accordingly.