The vulnerability identified as CVE-2026-42830 (CWE-426) affects the Microsoft Azure Monitor Agent Metrics Extension. It arises from an untrusted search path, which can be abused by an authorized local attacker to elevate privileges. The CVSS 3.1 base score is 6.5 (medium severity), with attack vector local, low attack complexity, and privileges required low. The impact includes high integrity impact but no confidentiality or availability impact. Microsoft has released an official fix and manages the patching process for this cloud-hosted service. The affected version explicitly stated is 1.0.0.

An authorized local attacker can exploit the untrusted search path vulnerability to elevate their privileges within the Azure Monitor Agent Metrics Extension environment. This could allow the attacker to execute code with higher privileges, potentially leading to unauthorized actions or modifications. There is no reported impact on confidentiality or availability. No known exploits are currently observed in the wild.

Microsoft has provided an official fix for this vulnerability and manages remediation for the Azure Monitor Agent Metrics Extension as a cloud service. Users should ensure their Azure Monitor Agent is updated as per Microsoft's guidance. No additional user action is required beyond applying the official fix provided by Microsoft.