The Azure SRE Agent contains a missing authorization check that lets an authenticated user gain higher privileges on the host machine. This flaw can enable the attacker to execute actions normally reserved for administrators, potentially compromising the entire system or network. The weakness is identified as CWE‑918, which denotes that the application fails to properly verify the origin of user requests.

The vulnerability applies to Microsoft Azure SRE Agent. Version details were not provided in the advisory, so all released builds of the Agent are considered affected until further notice.

The CVSS base score of 9.6 indicates a critical severity, reflecting the high impact of privilege escalation. No EPSS score is currently available, and the issue is not listed in the CISA KEV catalog, suggesting that limited data exists about active exploitation. The likely attack vector is a network‑based approach, as the missing authorization permits an authorized attacker over the network to achieve elevation of privilege. The required prerequisites are that the attacker already has legitimate access to the agent system.