Azure Monitor Agent contains an untrusted search path flaw that permits an attacker who already has authorized local access to elevate their privileges. The vulnerability is a classic privilege‑escalation weakness (CWE‑426) that can compromise system integrity if exploited. No remote exploitation path is described, so the impact is confined to local escalation.

Microsoft Azure Monitor Agent Metrics Extension is affected. No specific version information is provided; all deployed instances of the agent could potentially be at risk.

The CVSS score of 6.5 indicates a moderate severity risk, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation. The likely attack vector requires an attacker with legitimate local access or an existing foothold; upon exploiting the untrusted search path, privileges can be raised to the level of the agent process. Due to the lack of remote access predicated on this flaw, the risk is moderate but still significant for environments with sensitive data or critical operating roles.