High · 7.8 CVE-2026-26141 EUVD-2026-10700GHSA-rfgw-m548-mw46

Hybrid Worker Extension (Arc‑enabled Windows VMs) Elevation of Privilege Vulnerability

Published Mar 10, 2026 · Updated Oct 15, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Azure Automation Hybrid Worker Windows Extension Platform: Windows

Description

Improper authentication in Azure Arc allows an authorized attacker to elevate privileges locally.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Azure Automation Hybrid Worker Windows Extension	1.0.0 – < 1.3.74	1.3.74

Advisories 3

WID-SEC-2026-0655 Microsoft Azure Komponenten: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 10, 2026
NCSC-2026-0082 Kwetsbaarheden verholpen in Microsoft Azure NCSC-NL (Netherlands) · Mar 10, 2026
MSRC-CVE-2026-26141 Hybrid Worker Extension (Arc‑enabled Windows VMs) Elevation of Privilege Vulnerability Microsoft Security Response Center · Mar 10, 2026

References

Hybrid Worker Extension (Arc‑enabled Windows VMs) Elevation of Privilege Vulnerability vendor-advisory patch