A high-severity authentication bypass vulnerability in the Azure Connected Machine Agent allows authorized local users to achieve full privilege escalation.

This vulnerability is a flaw in authentication logic (CWE-288) that enables an attacker with local, authorized access to bypass security controls and gain elevated privileges. The attack vector is local, requiring the attacker to already possess a baseline level of access on the target system.

Successful exploitation of this vulnerability results in full privilege escalation, potentially granting an attacker administrative control over the affected virtual machine. Given the CVSS score of 7.8, this poses a significant risk to the confidentiality, integrity, and availability of the host, which could lead to unauthorized data access or complete system compromise.

Immediate Action: Update the Azure Connected Machine Agent to version 1.61 or later immediately to resolve the authentication bypass.

Proactive Monitoring: Review local system access logs and security event logs for unauthorized privilege escalation attempts or suspicious execution patterns originating from standard user accounts.

Compensating Controls: Ensure that local access to systems running the Azure Connected Machine Agent is restricted to authorized personnel only, following the principle of least privilege.

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub (https://github.com/j-dahl7/arc-cloud-c2-sentinel).

The risk of privilege escalation within cloud-managed infrastructure is significant, as it threatens the security of the entire environment. IT administrators must prioritize the deployment of the updated Azure Connected Machine Agent to version 1.61 or higher to mitigate this risk. Given the existence of a public proof-of-concept, prompt patching is required to prevent potential exploitation by unauthorized actors who have gained initial local access.