CVE-2026-96204
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
A server-side request forgery (SSRF) vulnerability in Azure Arc allows an authorized attacker to elevate privileges over a network.
Risk Assessment
An attacker can exploit SSRF to escalate privileges in the Azure Arc environment, gaining access to resources they should not reach.
Recommendation
Apply available security updates for Azure Arc. Restrict network access to Azure Arc services and monitor for unusual outbound requests.
Other vulnerabilities in Azure Arc
See all- CVE-2026-70009Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-69399Critical
Elevation of Privilege vulnerability in Azure Arc. Technical details were not provided in the description.
- CVE-2026-69555Critical
Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-65816Critical
Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-62895High
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
Original NVD description (English source)
Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS