PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40381 Microsoft CVE debrief

A local privilege escalation vulnerability exists in the Azure Connected Machine Agent due to improper access control (CWE-284). An attacker with local access and low privileges can exploit this flaw to gain elevated privileges on affected systems. The vulnerability is rated HIGH severity (CVSS 7.8) with a local attack vector, low attack complexity, and no user interaction required. Successful exploitation results in high impact to confidentiality, integrity, and availability. Microsoft has released version 1.63 of the Azure Connected Machine Agent to address this issue. Organizations should prioritize patching systems running vulnerable versions of the agent, particularly those where non-administrative users have local access.

Vendor
Microsoft
Product
Azure Connected Machine Agent
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-12
Original CVE updated
2026-05-18
Advisory published
2026-05-12
Advisory updated
2026-05-18

Who should care

Organizations using Azure Arc to manage on-premises, multi-cloud, or edge servers through the Azure Connected Machine Agent. System administrators responsible for Azure Arc deployments and security teams monitoring for privilege escalation risks in hybrid cloud environments.

Technical summary

The Azure Connected Machine Agent, used for Azure Arc-enabled servers, contains an improper access control vulnerability that permits authenticated local attackers to escalate privileges. The flaw exists in versions prior to 1.63 and can be exploited without user interaction. The agent runs with elevated privileges to manage server connectivity to Azure, and insufficient access controls on certain operations allow low-privileged users to execute actions with higher privileges. The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects significant risk for multi-user systems where non-administrative access is granted.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Azure Connected Machine Agent to version 1.63 or later
  • Audit systems for installations of Azure Connected Machine Agent prior to version 1.63
  • Review local user access controls on systems running the Azure Connected Machine Agent
  • Monitor for anomalous privilege escalation attempts on affected systems prior to patching
  • Apply principle of least privilege for local user accounts on Azure Arc-enabled servers

Evidence notes

The vulnerability is confirmed in NVD with vulnStatus 'Analyzed'. CPE criteria indicate affected versions are all versions prior to 1.63 of the Azure Connected Machine Agent. The CVSS 3.1 vector confirms local attack vector with high impact across all three security dimensions.

Official resources

Microsoft disclosed this vulnerability via the Microsoft Security Response Center (MSRC) on May 12, 2026, with subsequent analysis updates on May 18, 2026. The vulnerability has been assigned CWE-284 (Improper Access Control) and affects un