CVE-2026-26141
Published: 10 March 2026
Summary
CVE-2026-26141 is a high-severity Improper Authentication (CWE-287) vulnerability in Microsoft Azure Automation Hybrid Worker Windows Extension. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 19.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
CVE-2026-26141 is an improper authentication vulnerability affecting Azure Arc, published on 2026-03-10T18:18:42.957. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-287 (Improper Authentication) and CWE-863 (Incorrect Authorization). The issue enables an authorized attacker to elevate privileges locally due to flaws in the authentication mechanism.
A local attacker possessing low privileges (PR:L) can exploit this vulnerability with low attack complexity and no user interaction. Exploitation grants high impacts on confidentiality, integrity, and availability, allowing the attacker to escalate privileges on the affected Azure Arc-enabled system.
The Microsoft Security Response Center advisory provides details on mitigation and patches at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26141.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10700
Vulnerability details
Improper authentication in Azure Arc allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE describes local privilege escalation via improper authentication/authorization flaw in Azure Arc, directly matching exploitation of a software vulnerability for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
IA-2 requires unique identification and authentication of organizational users, directly addressing the improper authentication flaw that enables local privilege escalation in Azure Arc.
AC-3 enforces approved authorizations for access to system resources, mitigating the incorrect authorization (CWE-863) that allows low-privileged attackers to elevate privileges.
AC-6 applies least privilege to limit authorized accesses, preventing privilege escalation exploits even with flawed authentication mechanisms.