Microsoft patches four Azure privilege-escalation flaws
NCSC-NL relays a Microsoft advisory fixing four vulnerabilities in Azure components, including a CVSS 9.9 flaw in Azure Resource Manager and a 9.0 flaw enabling privilege escalation in Spring Cloud Azure.
NCSC-NL published an advisory summarizing Microsoft's fixes for four vulnerabilities across Azure services: Spring Cloud Azure, Azure Arc, Azure CycleCloud, and Azure Resource Manager (ARM). The most severe, CVE-2026-81961 (CVSS 9.9), affects ARM and allows privilege escalation, though no further technical detail is given in this advisory. CVE-2026-69854 (CVSS 9.0) in Spring Cloud Azure allows an attacker who already holds a valid session to escalate privileges under specific protocol or configuration conditions, potentially granting access to restricted functionality or data. CVE-2026-62895 (CVSS 8.8) in Azure Arc allows an unauthenticated attacker to host a malicious website and lure a user into visiting it; requests sent to a vulnerable locally-running service can then execute commands with elevated (SYSTEM) privileges — user interaction is required but authentication is not. CVE-2026-77909 (CVSS 7.7) affects Azure CycleCloud, where insufficiently protected credentials can be retrieved over the network by an authenticated attacker, exposing sensitive information including credentials.
No evidence of in-the-wild exploitation is cited in this advisory; it is a routine patch notification. Microsoft has released updates for all four issues via the Microsoft Security Response Center portal. Defenders operating any of the named Azure components (Spring Cloud Azure, Azure Arc, Azure CycleCloud, ARM) should apply the vendor updates promptly, review session and protocol configurations relevant to Spring Cloud Azure, and monitor for anomalous local service requests on Azure Arc-connected machines that could indicate exploitation attempts of CVE-2026-62895.
Mentioned in this report
Detection guidance
Azure Arc Local Service Privilege Escalation - Malicious Website Redirect
Detects suspicious HTTP requests to locally-running Azure Arc services that may indicate exploitation of CVE-2026-62895 leading to command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Azure Arc Local Service Privilege Escalation - Malicious Website Redirect
description: Detects HTTP requests targeting localhost or 127.0.0.1 on typical Azure
Arc local service ports (commonly 40342, 40343) that could indicate exploitation
of CVE-2026-62895. The vulnerability requires user interaction (visiting malicious
site) but no authentication, allowing command execution with elevated privileges
via a locally-running vulnerable service.
tags:
- attack.t1189
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationIp|cidr:
- 127.0.0.0/8
- ::1/128
DestinationPort:
- 40342
- 40343
Protocol: tcp
Initiated: 'true'
filter_legitimate:
Image|endswith:
- \GatewayManager.exe
- \AgentService.exe
condition: selection and not filter_legitimate
falsepositives:
- Legitimate Azure Arc agent health checks or management operations
level: medium
id: 0521af29-4719-5387-9b78-2dc94e3bb586
status: experimental
author: Vorant
Azure Spring Cloud Privilege Escalation via Valid Session
Detects HTTP requests with valid Azure authentication tokens accessing Spring Cloud Azure services with abnormal privilege-elevation patterns. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Azure Spring Cloud Privilege Escalation via Valid Session
description: Detects authenticated HTTP requests to Azure Spring Cloud services that
exhibit privilege-escalation behavior under specific protocol or configuration conditions
(CVE-2026-69854). This rule monitors for legitimate valid sessions being abused
to access restricted functionality.
tags:
- attack.t1078
logsource:
category: proxy
product: windows
detection:
selection:
c_uri|contains:
- /spring-cloud
- /api/v1/apps
- /api/v1/services
cs_User_Agent|contains: azure
sc_status: 200
cs_Authorization|contains: Bearer
filter_legitimate_user:
cs_username|contains:
- admin
- service
condition: selection and not filter_legitimate_user
falsepositives:
- Authorized administrator activity on Spring Cloud Azure services
- Legitimate application API calls with valid authentication tokens
level: medium
id: f23f1e58-eac3-5b11-8014-97937901a260
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0347.html
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free