Azure ARC vulnerabilities

2 known vulnerabilities in Azure ARC from Microsoft. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Azure ARC: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2026-70009Sep 17, 2026Microsoft

  Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

• 7.0 High severity

  Azure ARC: Improper Neutralization of Special Elements used in a Command

  CVE-2025-26627Mar 11, 2025Microsoft

  Improper neutralization of special elements used in a command ('command injection') in Azure Arc allows an authorized attacker to elevate privileges locally.