Loading vulnerability…
Local Privilege Escalation in Azure Monitor Agent
CVE-2026-32204 is a local elevation-of-privilege vulnerability in Microsoft Azure Monitor Agent on Linux. The flaw is caused by insufficient validation of file name and path values in configuration message handling, allowing external control over file paths processed by the agent. A locally authenticated attacker with low privileges can send specially crafted configuration messages to the agent and cause arbitrary file writes using the service's elevated execution context. This file-write primitive can then be leveraged to execute unauthorized code and escalate privileges to root.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows a low-privilege local user to gain root privileges on the affected Linux host. Because the vulnerability can provide arbitrary file write capability in the context of the privileged agent service, it can lead to unauthorized code execution, full system compromise, modification of protected files, access to sensitive data, and disruption of system availability. Microsoft assessed confidentiality, integrity, and availability impact as High.
If you can’t patch tonight, do this now.
No vendor workaround is documented beyond applying the official fix. Until patching is completed, reduce exposure by restricting local access to affected Linux systems, minimizing the number of users and processes able to interact with the locally running Azure Monitor Agent service, and enforcing least privilege on shared or multi-user hosts. Enabling automatic extension update can help reduce future patch latency.
Patch, then assume compromise.
Upgrade Azure Monitor Agent to the vendor-fixed release, build 1.14.0 or later. Microsoft designated the remediation as an official fix and indicated that customer action is required. Because Azure Monitor Agent security fixes are released only to the latest supported version set, organizations should ensure deployments are updated to a currently supported release and validate that vulnerable pre-1.14.0 Linux installations are no longer in use.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.