CVE-2026-70009
CriticalCVSS 9.3Summary
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
Risk Assessment
An attacker could escape the permitted directory and elevate privileges, potentially resulting in unauthorized access to resources managed by Azure Arc.
Recommendation
Apply Azure Arc updates and review permission configuration and path validation.
Other vulnerabilities in Azure Arc
See all- CVE-2026-69399Critical
Elevation of Privilege vulnerability in Azure Arc. Technical details were not provided in the description.
- CVE-2026-69555Critical
Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-65816Critical
Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-62895High
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
Original NVD description (English source)
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.