CVE-2026-40381: Azure Connected Machine Agent Elevation of Privilege Vulnerability
CVE-2026-40381 is an elevation of privilege vulnerability in Azure Connected Machine Agent, rated Important by Microsoft, with a CVSS 3.1 base score of 7.8 (High). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.22% probability of exploitation activity in the next 30 days, higher than 13% of all scored vulnerabilities. Microsoft released the fix on 12 May 2026 in the May 2026 Patch Tuesday. It affects 1 product in 1 product family (Azure).
Key facts
- CVE ID
- CVE-2026-40381
- Severity
- High CVSS 7.8
- Microsoft severity
- Important
- Impact
- Elevation of Privilege
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-284
- EPSS
- 0.22% (percentile 13%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- May 2026 Patch Tuesday
- Product families
- Azure
CVSS score and vector
Microsoft scores CVE-2026-40381 at 7.8 (temporal 6.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
Frequently asked questions (Microsoft)
How could an attacker exploit this vulnerability?
An attacker who already has access to the affected system could interfere with a local service port used by ArcProxy and respond with specially crafted authentication data. By doing this, the attacker can cause the service to access and return files that would normally only be available to a more privileged system account, potentially exposing sensitive information.
Affected products (1)
Azure
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Azure Connected Machine Agent | Release Notes | Security Update (Windows) | 1.63 | No |
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 7.8 (HIGH)
- NVD weakness
- CWE-284
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| azure connected machine agent | before 1.63 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40381 (Vendor Advisory)
Acknowledgments
- Eli Arshin with Microsoft
- Michal Kamensky with Microsoft
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |