This vulnerability is an access‑control weakness that lets an attacker who already has authorized access to a machine managed by Azure Connected Machine Agent elevate their privileges. By abusing the improper permission checks, the attacker can gain higher level rights on the local system, potentially allowing them to read, modify, or delete critical data and configurations, thereby compromising system integrity and confidentiality.

The affected component is Microsoft Azure Connected Machine Agent. No specific version details are provided, so all deployments of this agent are potentially impacted until a vendor fix is applied.

The CVSS score of 7.8 indicates a medium‑to‑high severity for this flaw. The EPSS score is not available, so the likelihood of exploitation is currently unknown, but the vulnerability is not listed in CISA’s KEV catalog. The attack vector appears to be local, requiring an attacker to already possess authorized credentials on the target machine. Because the flaw allows privilege escalation from authenticated states, the risk to exposed systems is significant if the agent runs with elevated rights.