CVE-2026-26141

HIGH

Azure Automation Hybrid Worker Windows Extension < 1.3.74 - Privilege Escalation via Improper Authentication

Title source: llm

Improper authentication in Azure Arc allows an authorized attacker to elevate privileges locally.

Core 1

Core References

Vendor Advisory vendor-advisory patch

CVSS v3 7.8

EPSS 0.0029

EPSS Percentile 20.7%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

CWE

CWE-863 CWE-287

Status published

Products (2)

Microsoft/Azure Automation Hybrid Worker Windows Extension 1.0.0 - 1.3.74

microsoft/azure_automation_hybrid_worker_windows_extension 1.0.0 - 1.3.74

Published Mar 10, 2026

Tracked Since Mar 11, 2026