Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
How could an attacker exploit this vulnerability? An attacker who already has access to the affected system could interfere with a local service port used by ArcProxy and respond with specially crafted authentication data. By doing this, the attacker can cause the service to access and return files that would normally only be available to a more privileged system account, potentially exposing sensitive information.
Eli Arshin with Microsoft, Michal Kamensky with Microsoft