Improper access control in Azure Arc lets an unauthorized attacker gain elevated privileges over the network, allowing unauthorized manipulation of Azure Arc resources. This flaw enables the attacker to bypass defined security boundaries and perform actions that require higher permissions, potentially compromising the confidentiality, integrity, and availability of the affected environment.

Microsoft Azure Arc is affected. No specific version information is available in the provided data.

The CVSS score of 8.6 indicates a high severity vulnerability. With an EPSS score of less than 1%, the likelihood of exploitation is low, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be network-based, as the description states the attacker must be able to reach Azure Arc over a network to exploit improper access controls.