CVE-2025-62550: Azure Monitor Agent Remote Code Execution Vulnerability
CVE-2025-62550 is a remote code execution vulnerability in Azure Monitor Agent, rated Important by Microsoft, with a CVSS 3.1 base score of 8.8 (High). An attacker can exploit it remotely over the network, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.80% probability of exploitation activity in the next 30 days, higher than 57% of all scored vulnerabilities. Microsoft released the fix on 8 December 2025 in the December 2025 Patch Tuesday. It affects 1 product in 1 product family (Azure).
Key facts
- CVE ID
- CVE-2025-62550
- Severity
- High CVSS 8.8
- Microsoft severity
- Important
- Impact
- Remote Code Execution
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-131; CWE-787
- EPSS
- 0.80% (percentile 57%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- December 2025 Patch Tuesday
- Product families
- Azure
CVSS score and vector
Microsoft scores CVE-2025-62550 at 8.8 (temporal 7.7) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network.
Frequently asked questions (Microsoft)
According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.
How could an attacker exploit this vulnerability?
An attacker with local network access to an Azure Linux Virtual Machine running Azure Monitor could exploit a heap overflow to escalate privileges to the syslog user, enabling execution of arbitrary commands.
Affected products (1)
Azure
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Azure Monitor Agent | Release Notes | Security Update | 1.35.9 | No |
NIST NVD data
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| azure monitor agent | before 1.35.9 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-62550 (Vendor Advisory)
Acknowledgments
- P1hcn
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |