Microsoft disclosed a missing authorization flaw in Azure SRE Agent, rated CVSS 9.9 CRITICAL, that lets an already-authenticated attacker escalate privileges across a network and beyond the agent's own security scope.
What Is It
CVE-2026-62830 is a missing authorization vulnerability (CWE-862) in Microsoft's Azure SRE Agent. Per Microsoft's description, the flaw "allows an authorized attacker to elevate privileges over a network." The CVE remains in a Received vulnerability status at NVD, meaning the record has not yet completed NVD analysis.
The assigned CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base score 9.9, CRITICAL. Microsoft ([email protected]) is the assigning source and the primary metric provider.
Why It Matters
The vector breaks down badly for defenders. The attack is network-reachable (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N). The privilege barrier is low (PR:L), meaning an attacker needs some level of authorized access, though the metric alone does not specify which roles or identity types are sufficient. Critically, scope is Changed (S:C), meaning successful exploitation impacts resources beyond the vulnerable component's own security authority. Confidentiality, integrity, and availability impacts are all HIGH, with an exploitability subscore of 3.1 and impact subscore of 6.0.
That combination, low-privileged network access producing full compromise with scope change, is what drives the 9.9 rating.
What's Vulnerable
- Vendor: Microsoft
- Product: Azure SRE Agent
- Affected versions: listed as
-(no discrete version enumeration); no CPE entries are present in the NVD record.
Microsoft tagged the CVE exclusively-hosted-service. This indicates the affected product is a service Microsoft hosts, rather than software customers deploy and version themselves.
Patch Status
No CISA KEV entry exists for CVE-2026-62830, so there is no KEV-mandated remediation deadline or required action. KEV absence is a narrow signal: it means CISA has not added the CVE to the catalog, not that exploitation has been ruled out. Catalog additions lag observed activity, and exploitation of a Microsoft-hosted service may be visible to the vendor without ever producing a KEV entry. No public reporting of active exploitation had surfaced as of this writing.
The NVD record lists no patch, mitigation, or workaround details beyond the single MSRC reference. Given the exclusively-hosted-service tag, customers should consult the MSRC update guide entry directly for Microsoft's statement on remediation status and whether any customer action is required.
Sources
- NVD, CVE-2026-62830: https://nvd.nist.gov/vuln/detail/CVE-2026-62830
- Microsoft MSRC Update Guide; CVE-2026-62830: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62830
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog