Microsoft has disclosed CVE-2026-69399, a critical elevation of privilege vulnerability in Azure Arc carrying the maximum possible CVSS v3.1 base score of 10.0.
What Is It
CVE-2026-69399 is described by Microsoft as an "Azure Arc Elevation of Privilege Vulnerability." The flaw is classified under CWE-441 (Unintended Proxy or Intermediary, commonly called the "Confused Deputy" problem), a weakness class where a component with elevated authority is tricked into performing actions on behalf of an unauthorized caller.
The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, yielding a base score of 10.0 (CRITICAL) with an exploitability subscore of 3.9 and an impact subscore of 6.0. Every exploitability metric is at its worst value: the attack is reachable over the network, requires low attack complexity, requires no privileges, and requires no user interaction.
Why It Matters
A perfect 10.0 is rare and is driven here by the combination of unauthenticated network reachability and a changed scope (S:C), meaning successful exploitation impacts resources beyond the vulnerable component's own security authority. Confidentiality, integrity, and availability impacts are all rated HIGH.
The record was published by Microsoft's security response identifier ([email protected]) on 2026-09-17 and remains in Received status in NVD, meaning NVD analysis is not yet complete.
What's Vulnerable
The affected product is listed as Microsoft Azure Arc, with version recorded as - (i.e., not version-scoped). No CPE match data is currently published in the NVD record.
Microsoft tagged this CVE as exclusively-hosted-service. That tag indicates the vulnerability exists in a service Microsoft hosts and operates.
Patch Status
No CISA KEV entry was supplied for CVE-2026-69399, so there is no confirmation of active exploitation and no KEV-mandated remediation deadline or required action in the provided source material.
The supplied data contains no patch version, workaround, or mitigation details beyond the Microsoft Security Response Center advisory reference. Because the CVE is tagged as an exclusively hosted service, consult the MSRC update guide entry directly for Microsoft's statement on remediation and any customer action required.
Sources
- NVD, CVE-2026-69399: https://nvd.nist.gov/vuln/detail/CVE-2026-69399
- Microsoft MSRC Update Guide; CVE-2026-69399: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69399