CVE-2026-69399Disclosure(microsoft / azure_arc)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch microsoft azure_arc systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Unintended proxy or intermediary in Azure Arc allows an authorized attacker to elevate privileges over a network.

0.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-441

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • azure_arc

Threat summary

  • Patch or workaround signal is available
  • 6 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 5 signals
  • Disclosure: 5 classified signals
  • General: 1 classified signal
  • Peaked 2d ago at 4 mentions (2026-09-18); latest day: 1
  • 6 total mentions across 3 days

Affected systems

Vendors
Products
azure_arc

1 version affected across 1 product

Deep dive

Activity timeline6 mentions / 3d
01234Mentions · 2026-09-18: 4Mentions · 2026-09-22: 1Mentions · 2026-09-23: 1Patch / Workaround · 2026-09-22: 1Technical Details · 2026-09-18: 3Technical Details · 2026-09-22: 1Technical Details · 2026-09-23: 109-1809-2209-23
Signal classification2 categories
Disclosure
583.3%
General
116.7%
Referenced assets5 URLs
Classification over time
DateTotalLabels
2026-09-184
Disclosure3General1
2026-09-221
Disclosure1
2026-09-231
Disclosure1
Full discourse6 posts
  • Nathan McNulty@NathanMcNulty
    Disclosure

    How did I miss the CVSS 10 on Azure Arc?!? 🫠 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69399 I've long complained about unnecessarily requiring a management tool just to ship some logs or onboard to Defender for Endpoint Be careful out there... https://x.com/NathanMcNulty/status/1893141503276421518?s=20

    Post summary

    The tweet discloses a newly disclosed Azure Arc vulnerability (CVE‑2026‑69399) with a CVSS score of 10, alerting users to be cautious, but does not include PoC, exploit code, evidence of active exploitation, or patch information.

    81811279014.1K
    19.5K followersView on X
  • Rıdvan Yağlı@ridvanyagli
    Disclosure

    Microsoft / Azure tarafında bugün yayınlanan kritik güvenlik açıkları: — CVE-2026-69843: Microsoft Fabric CVSS: 10.0 Etkisi: Kimlik doğrulama atlatma (spoofing). Yetkisiz bir saldırganın ağ üzerinden kimlik doğrulamayı aşarak yetki yükseltmesine izin veriyor. — CVE-2026-62874: Azure Billing CVSS: 10.0 Etkisi: Veri doğrulama yetersizliği. Saldırgan tarafından sağlanan verinin yeterince doğrulanmaması, ağ üzerinden yetki yükseltmeye yol açabiliyor. — CVE-2026-85889: Azure AI Foundry CVSS: 10.0 Etkisi: Kritik bir fonksiyonda kimlik doğrulama eksikliği. Yetkisiz saldırgan ağ üzerinden kritik işlevi çağırarak yetki yükseltebiliyor. — CVE-2026-69865: Microsoft/Azure Container Registry CVSS: 10.0 Etkisi: Kullanıcı kontrollü anahtar üzerinden yetkilendirme atlatma. Yetkisiz saldırganın ağ üzerinden yetki yükseltmesine izin veriyor. — CVE-2026-69399: Azure Arc CVSS CVSS: 10.0 Etkisi: Confused Deputy / istem dışı proxy problemi. Azure Arc'ın başka bir güvenlik bağlamında gerçekleştirdiği işlemler kötüye kullanılarak yetki yükseltme mümkün. — CVE-2026-85878: Azure Database for PostgreSQL CVSS: 9.9 Etkisi: Hatalı yetkilendirme. Düşük seviyede yetkisi olan bir saldırgan ağ üzerinden daha yüksek yetkiler elde edebiliyor. — CVE-2026-87701: Azure Cosmos DB CVSS: 9.6 Etkisi: Injection açığı. Çıktıdaki özel karakterlerin yeterince filtrelenmemesi, yetkili bir saldırganın ağ üzerinden yetki yükseltmesine yol açabiliyor. — CVE-2026-85885: Microsoft 365 Copilot CVSS: 9.9 Etkisi: Command injection. Yetkili bir saldırganın özel hazırlanmış girdilerle komut enjeksiyonu gerçekleştirerek yetki yükseltmesine neden olabiliyor.

    Post summary

    The tweet announces multiple critical Azure/Microsoft CVEs with CVSS scores and brief impact descriptions, providing technical details but no PoC, exploit, active exploitation, or patch information.

    00030288
    2.5K followersView on X
  • SecAlerts@SecAlertsCo
    Disclosure

    ☁️ Azure Arc: CVSS 10 Elevation of Privilege - CVE-2026-69399. No auth, no user interaction, full network access, complete CIA compromise. If Azure Arc is in your stack, patch now. #cybersecurity #ciso #cto #Azure #Microsoft #vulnerabilities https://secalerts.co/vulnerability/CVE-2026-69399?utm_campaign=x https://t.co/Mrwz6AjMAW

    Post summary

    The tweet discloses CVE-2026-69399 affecting Azure Arc, describing it as a CVSS 10 elevation of privilege requiring no authentication or user interaction, and urges users to patch now.

    1000182
    890 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-69399 Azure Arc Elevation of Privilege Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-69399

    Post summary

    The text is a brief disclosure-style mention of CVE-2026-69399 affecting Azure Arc, identifying it as an elevation-of-privilege vulnerability. It does not provide PoC, exploit code, active exploitation claims, remediation, or debunking information.

    000201.8K
    58.2K followersView on X
  • ExploitGrid@exploitgrid
    Disclosure

    [CVE] CVE-2026-69399 [HIGH PRIORITY] #Azure Arc Elevation of Privilege Vulnerability 🔗 https://exploitgrid.net/cve/CVE-2026-69399

    Post summary

    The text briefly identifies CVE-2026-69399 as an Azure Arc privilege-escalation vulnerability. It provides no evidence of exploitation, PoC code, remediation, or supporting technical details.

    1000057
    47 followersView on X
  • ExploitGrid@exploitgrid
    General

    🛡️ #ExploitGrid Daily #Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-54734 CVE-2026-62104 CVE-2026-62874 CVE-2026-69399 CVE-2026-69843 ..🧵👇

    Post summary

    The tweet serves as a daily threat digest header listing five CVE identifiers for 2026 without providing any technical details, exploitation status, proof-of-concept availability, or remediation information.

    1000062
    47 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appmicrosoftazure_arc---

Explore more