Microsoft patches four Azure privilege-escalation flaws
NCSC-NL relays a Microsoft advisory fixing four vulnerabilities in Azure components, including a CVSS 9.9 flaw in Azure Resource Manager and a 9.0 flaw enabling privilege escalation in Spring Cloud Azure.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 4 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
NCSC-NL published an advisory summarizing Microsoft's fixes for four vulnerabilities across Azure services: Spring Cloud Azure, Azure Arc, Azure CycleCloud, and Azure Resource Manager (ARM). The most severe, CVE-2026-81961 (CVSS 9.9), affects ARM and allows privilege escalation, though no further technical detail is given in this advisory. CVE-2026-69854 (CVSS 9.0) in Spring Cloud Azure allows an attacker who already holds a valid session to escalate privileges under specific protocol or configuration conditions, potentially granting access to restricted functionality or data. CVE-2026-62895 (CVSS 8.8) in Azure Arc allows an unauthenticated attacker to host a malicious website and lure a user into visiting it; requests sent to a vulnerable locally-running service can then execute commands with elevated (SYSTEM) privileges — user interaction is required but authentication is not. CVE-2026-77909 (CVSS 7.7) affects Azure CycleCloud, where insufficiently protected credentials can be retrieved over the network by an authenticated attacker, exposing sensitive information including credentials.
No evidence of in-the-wild exploitation is cited in this advisory; it is a routine patch notification. Microsoft has released updates for all four issues via the Microsoft Security Response Center portal. Defenders operating any of the named Azure components (Spring Cloud Azure, Azure Arc, Azure CycleCloud, ARM) should apply the vendor updates promptly, review session and protocol configurations relevant to Spring Cloud Azure, and monitor for anomalous local service requests on Azure Arc-connected machines that could indicate exploitation attempts of CVE-2026-62895.
Mentioned in this report
Detection guidance
Azure Arc Local Service Privilege Escalation - Malicious Website Redirect
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects suspicious HTTP requests to locally-running Azure Arc services that may indicate exploitation of CVE-2026-62895 leading to command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Azure Arc Local Service Privilege Escalation - Malicious Website Redirect
description: Detects HTTP requests targeting localhost or 127.0.0.1 on typical Azure
Arc local service ports (commonly 40342, 40343) that could indicate exploitation
of CVE-2026-62895. The vulnerability requires user interaction (visiting malicious
site) but no authentication, allowing command execution with elevated privileges
via a locally-running vulnerable service.
tags:
- attack.t1189
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationIp|cidr:
- 127.0.0.0/8
- ::1/128
DestinationPort:
- 40342
- 40343
Protocol: tcp
Initiated: 'true'
filter_legitimate:
Image|endswith:
- \GatewayManager.exe
- \AgentService.exe
condition: selection and not filter_legitimate
falsepositives:
- Legitimate Azure Arc agent health checks or management operations
level: medium
id: 0521af29-4719-5387-9b78-2dc94e3bb586
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0347.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs