Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.
Details
What actions do customers need to take to protect themselves from this vulnerability?
Customers should update their Azure Connected Machine Agent to the latest version. For more information, see What's new with Azure Connected Machine agent.
What privileges could an attacker gain with successful exploitation?
An attacker who successfully exploited the vulnerability could elevate their privileges as ‘NT AUTHORITY\SYSTEM’ user and perform arbitrary code execution.
According to the CVSS metric, the attack vector is local (AV:L) and privileges required is low (PR:L). What does this mean in the context of this elevation of privilege vulnerability?
An attacker needs to be authorized as a standard user on the localhost to execute this attack. They could then elevate their privileges to perform unauthorized operations.
Security updates
1.49 — https://learn.microsoft.com/en-us/azure/azure-arc/servers/agent-release-notes#version-149---february-2025
Vulnerabilities 1
-
High 7.8
Azure Connected Machine Agent Elevation of Privilege Vulnerability
Improper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally.
Revision history
-
#1
Information published.
References
-
CVE-2025-49692 Azure Connected Machine Agent Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49692
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss