This vulnerability (CWE-22) in Microsoft Azure ARC arises from improper limitation of a pathname to a restricted directory, commonly known as a path traversal flaw. It enables an unauthorized attacker to elevate privileges remotely over the network. The CVSS 3.1 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, partial confidentiality impact, high integrity impact, and no availability impact. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

An attacker exploiting this vulnerability can elevate privileges remotely without authentication, potentially gaining unauthorized access to sensitive resources or performing unauthorized actions within Azure ARC. The impact includes partial confidentiality loss and high integrity compromise, but availability is not affected. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. As Azure ARC is a cloud service, Microsoft manages the remediation server-side. Users should ensure their Azure ARC instances are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70009 to mitigate this vulnerability.