CVE-2026-69399
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A vulnerability in Azure Arc involves unintended proxy or intermediary behavior, allowing an authorized attacker to elevate privileges over a network.
Risk Assessment
An authenticated attacker could exploit Azure Arc as an intermediary to escalate privileges, potentially leading to unauthorized access to cloud resources and data.
Recommendation
Apply available security updates for Azure Arc promptly and restrict network access to only necessary trusted sources.
Other vulnerabilities in Azure Arc
See all- CVE-2026-70009Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69555Critical
Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-65816Critical
Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-96204Medium
A server-side request forgery (SSRF) vulnerability in Azure Arc allows an authorized attacker to elevate privileges over a network.
- CVE-2026-62895High
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
Original NVD description (English source)
Unintended proxy or intermediary in Azure Arc allows an authorized attacker to elevate privileges over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS