rootpwn

critical · CVSS v3 9.3

CVE-2026-70009

CVE‑2026‑70009 is a path‑traversal flaw in Azure Arc that lets an unauthenticated attacker gain elevated privileges over the network. The vu

Overview

CVE‑2026‑70009 is a path‑traversal flaw in Azure Arc that lets an unauthenticated attacker gain elevated privileges over the network. The vulnerability can be exploited to read or modify restricted files and execute arbitrary code on Azure‑Arc‑enabled hosts. It is rated critical with a CVSS v3 score of 9.3.

Description

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

Impact

The flaw compromises confidentiality, integrity, and availability of the affected hosts. An attacker can read or tamper with system files, execute code with elevated privileges, and potentially disrupt services or exfiltrate data. Azure Arc users running on-premises or hybrid workloads are directly impacted, as the vulnerability is exploitable over the network without local authentication.

Remediation

1. Apply the latest Microsoft patch or upgrade to the newest Azure Arc agent version. 2. Restrict network access to the Arc agent by using firewall rules or Azure Network Security Groups. 3. Enforce least‑privilege for Arc service principals and disable unused features. 4. Enable Azure Policy or Azure Security Center to monitor for abnormal file access or privilege escalation. 5. Conduct regular vulnerability scans and verify that the path‑traversal fix is in place.

Risk context

With a CVSS v3 score of 9.3 and no EPSS data, the vulnerability is considered highly urgent. Immediate patching and network hardening are recommended to mitigate the risk of privilege escalation and potential data compromise.

Affected products

  • Azure Arc
  • Azure Arc‑enabled servers
  • Azure Arc‑enabled Kubernetes
  • Azure Arc‑enabled data services
  • Azure Arc‑enabled SQL
  • Azure Arc‑enabled VMware
  • Azure Arc‑enabled GitHub
  • Azure Arc‑enabled Azure services

Scores

Severity
critical
CVSS v2
8.5
CVSS v3
9.3
CVSS v4
—
EPSS
—

path-traversal Azure Arc privilege-escalation critical network on-prem patch

← All CVEs

Related CVEs

critical

CVE-2026-62874

CVE‑2026‑62874 exposes a flaw in Azure Billing where data authenticity is not properly verified. An attacker can exploit this to gain elevated privileges on the network, potentially accessing or modifying billing and subscription data. The vulnerability is critical with a CVSS v3 score of 10.0.

View analysis

critical

CVE-2026-69843

CVE‑2026‑69843 is a critical authentication bypass in Microsoft Fabric that lets an attacker spoof credentials and gain elevated privileges across the network. The flaw allows unauthorized users to impersonate legitimate accounts, potentially accessing sensitive data and services. It is a high‑risk vulnerability that requires immediate attention from defenders.

View analysis

critical

CVE-2026-85878

CVE-2026-85878 exposes an improper authorization flaw in Azure Database for PostgreSQL that lets an authenticated user gain elevated privileges across the network. The vulnerability can be exploited by users who already have access to the database, enabling them to perform actions beyond their intended scope. It is critical because it bypasses normal role boundaries and can lead to widespread compromise of data and services.

View analysis

critical

CVE-2026-93453

SOGo versions before 5.12.11 can construct password-reset links using a client-supplied Origin header as the link authority. This can cause valid recovery tokens to be delivered in links pointing to attacker-controlled domains. It matters because it can enable account takeover for users who rely on SOGo password recovery.

View analysis