CVE-2026-69555: CWE-863: Incorrect Authorization in Microsoft Azure ARC

CVE-2026-69555 is an incorrect authorization vulnerability (CWE-863) in Microsoft Azure ARC. It enables an attacker with network access and no privileges to escalate their privileges, potentially compromising confidentiality and integrity of the system. The vulnerability is rated critical with a CVSS 3.1 base score of 10.0, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and complete confidentiality and integrity impact. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

An attacker can elevate privileges without prior authorization, leading to full compromise of confidentiality and integrity within the Azure ARC environment. This could allow unauthorized access to sensitive data or control over resources managed by Azure ARC.

Microsoft has released an official fix for this vulnerability. Since Azure ARC is a cloud service, Microsoft manages the remediation server-side. Users should follow the guidance in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69555 to ensure their environment is updated and protected.