Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network. The flaw permits a malicious actor to present a forged certificate to the agent, causing it to establish trust and gain elevated rights on the host. This weakness is categorized as CWE‑295, indicating insecure cryptographic practice.

Microsoft’s Azure Connected Machine Agent is affected. The CVE report does not specify exact releases, so any installations that use the default certificate validation logic may be vulnerable. Administrators should review deployed agent versions against vendor documentation to determine exposure.

The CVSS score of 8.8 denotes a high severity of privilege escalation. The EPSS score of less than 1 % indicates that public exploitation is currently rare, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an adjacent network segment where an attacker can inject a forged certificate into the agent, the attacker can elevate privileges on the host machine, potentially compromising the monitored environment.