Loading vulnerability…
Azure Arc Path Traversal Elevation of Privilege
CVE-2026-70009 is a critical path traversal vulnerability in the Microsoft-managed Azure Arc service. Improper limitation of a pathname to an authorized directory enables an unauthenticated remote attacker to access or operate outside the intended restricted path context and elevate privileges. The issue is classified as CWE-22 and is an exclusively hosted-service vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits network-based elevation of privilege without authentication or user interaction. The CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N (9.3), indicating low confidentiality impact, high integrity impact, no availability impact, and impact extending beyond the vulnerable security authority.
If you can’t patch tonight, do this now.
No customer workaround or temporary mitigation is required because Microsoft has already mitigated the issue in the hosted service. Organizations should verify the service remediation status through applicable Microsoft security communications.
Patch, then assume compromise.
Microsoft has fully remediated the vulnerability in the Azure Arc cloud service. No customer-applied update or configuration change is required.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.