This vulnerability arises from improper input validation in Azure Monitor Agent that permits an attacker with authorized local access to elevate privileges. By supplying specially crafted input, the attacker can gain elevated rights on the affected system, allowing full compromise of that machine. The weakness maps to CWE‑20, indicating that lack of validation can be used to bypass security boundaries.

Microsoft Azure Monitor Agent is the affected product. The specific agent version list is not detailed in the supplied data. Any installation of Azure Monitor Agent that has not been patched to the latest release could be vulnerable.

The CVSS v3.1 score of 7.8 classifies this flaw as High severity. No EPSS score is available, and it is not listed in the CISA KEV catalog. Exploitation requires that the attacker already has a foothold and is authorized to submit data to the agent. Once the input is accepted, the privilege escalation can occur with relatively minimal effort, leading to potential full system compromise. Because the attack vector is local, the risk is confined to systems where the agent is installed and the attacker can craft input.