CVE-2026-42830: Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability
CVE-2026-42830 is an elevation of privilege vulnerability in Azure Monitor Agent Metrics Extension, rated Important by Microsoft, with a CVSS 3.1 base score of 6.5 (Medium). An attacker can exploit it by an attacker with local access, with low privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.47% probability of exploitation activity in the next 30 days, higher than 41% of all scored vulnerabilities. Microsoft released the fix on 12 May 2026 in the May 2026 Patch Tuesday. It affects 1 product in 1 product family (Azure).
Key facts
- CVE ID
- CVE-2026-42830
- Severity
- Medium CVSS 6.5
- Microsoft severity
- Important
- Impact
- Elevation of Privilege
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-426
- EPSS
- 0.47% (percentile 41%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- May 2026 Patch Tuesday
- Product families
- Azure
CVSS score and vector
Microsoft scores CVE-2026-42830 at 6.5 (temporal 5.7) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Changed |
| Confidentiality impact | None |
| Integrity impact | High |
| Availability impact | None |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
Frequently asked questions (Microsoft)
According to the CVSS metrics, successful exploitation of this vulnerability could lead to no loss of confidentiality (C:N) and availability (A:N), but could lead to major loss of integrity (I:H). What does that mean for this vulnerability?
This primarily impacts integrity, as an attacker could execute unauthorized code and modify system behavior or trusted processes. There is no direct impact to confidentiality, as the scenario does not inherently provide access to sensitive data, and no impact to availability, as exploitation does not inherently disrupt service operation.
According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
What privileges an attacker could gain with a successful exploitation?
The OpenSSL configuration auto‑loading behavior allows extension modules (such as MetricsExtension) to load automatically. Therefore, if an attacker was able to place a malicious DLL in a location referenced by the configuration, it could get loaded implicitly, that could result in arbitrary code execution with elevated privileges.
Affected products (1)
Azure
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Azure Monitor Agent Metrics Extension | Release Notes | Security Update | 1.42.0 | No |
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 6.5 (MEDIUM)
- NVD weakness
- CWE-426
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| azure monitor agent | before 1.42.0 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42830 (Vendor Advisory)
Acknowledgments
- Cristhian Parrot with Kroll
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |