CVE-2026-62895
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
Risk Assessment
An unauthorized attacker could exploit loose domain policy to gain elevated privileges, potentially compromising the environment.
Recommendation
Configure strict cross-domain policies and apply vendor security patches.
Other vulnerabilities in Azure Arc
See all- CVE-2026-70009Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69399Critical
Elevation of Privilege vulnerability in Azure Arc. Technical details were not provided in the description.
- CVE-2026-69555Critical
Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-65816Critical
Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-96204Medium
A server-side request forgery (SSRF) vulnerability in Azure Arc allows an authorized attacker to elevate privileges over a network.
Original NVD description (English source)
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS