Azure Arc contains an elevation of privilege flaw that allows an attacker to gain higher privileges within the Azure environment. The weakness is identified as CWE-441, which can enable unauthorized escalation of access rights. The impact is limited to scenarios where an attacker can reach the affected component, potentially allowing them to control resources managed by Azure Arc.

Microsoft Azure Arc is affected. No specific version or build information is provided, so any deployment of Azure Arc may be vulnerable until a fix is applied.

The CVSS score of 10 indicates maximum severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is not disclosed in the official description; it is inferred that the exploitation could occur via trusted Azure Arc components, either internally or remotely. The high severity warrants immediate attention.