CVE-2025-47989
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Azure Connected Machine Agent has an improper access control vulnerability that allows an authorized attacker to elevate privileges locally.
Risk Assessment
An authorized user could gain higher privileges on the system, potentially leading to unauthorized configuration changes or access to sensitive data.
Recommendation
Update Azure Connected Machine Agent to the latest version that includes the fix. Audit local user privileges.
Other vulnerabilities in Azure Connected Machine Agent
See all- CVE-2026-40381High
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
- CVE-2026-21224High
Stack-based buffer overflow in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
- CVE-2026-47632High
Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network.
- CVE-2025-58724High
Azure Connected Machine Agent has an improper access control vulnerability that allows an authorized attacker to elevate privileges locally.
- CVE-2024-21329High
Vulnerability in Azure Connected Machine Agent allows elevation of privilege. An attacker could exploit it to gain higher privileges on the system.
Original NVD description (English source)
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS