Microsoft Patches Elevation-of-Privilege Flaws in Azure Monitoring and Agent Components

Microsoft disclosed and patched multiple elevation-of-privilege vulnerabilities affecting Azure agent components, including Azure Monitor Agent, the Azure Monitor Agent Metrics Extension, the Azure Connected Machine Agent, and the Azure Network Watcher VM Extension. The newly detailed issues include CVE-2026-32204, an Important flaw in Azure Monitor Agent caused by external control of file name or path (CWE-73), and CVE-2026-42830, an Important untrusted search path vulnerability (CWE-426) in the Metrics Extension. Microsoft said both flaws could be exploited locally by low-privileged attackers to gain elevated privileges, with CVE-2026-32204 potentially enabling file writes and unauthorized code execution as root, while CVE-2026-42830 could lead to privilege escalation and arbitrary code execution through implicit loading behavior tied to OpenSSL configuration handling.

The disclosures add to a broader pattern of privilege-escalation fixes across Azure management tooling, following earlier advisories for CVE-2024-35254 in Azure Monitor Agent, CVE-2023-35624 in Azure Connected Machine Agent, and CVE-2025-21188 in the Azure Network Watcher VM Extension. Microsoft assigned a CVSS 3.1 score of 7.8 to CVE-2026-32204 and 6.5 to CVE-2026-42830, said neither issue was publicly disclosed or exploited at the time of publication, and released official fixes. Microsoft credited Cristhian Parrot of Kroll for reporting CVE-2026-42830 through coordinated vulnerability disclosure.