CVE-2026-69399 is an elevation of privilege vulnerability in Microsoft Azure Arc with the maximum CVSS score of 10.0. The record gives only the title and a weakness class. I could not read Microsoft's advisory page, so check it for affected components and fixed versions before you act.
What's affected
- Product: Microsoft Azure Arc. The record does not say which Arc component or agent is involved.
- Weakness: CWE-441 unintended proxy or intermediary, often called a confused deputy.
- Severity: CVSS 3.1 10.0, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. No privileges or user action, with a changed scope. - Fixed version: not confirmed. Microsoft's page needs JavaScript and did not load for me.
How to check if you're exposed
On an Arc enabled server, the connected machine agent reports its own version:
azcmagent version
azcmagent show
Arc also covers other resources, such as Kubernetes clusters and data services, so list which Arc enabled resources you have in the Azure portal under Azure Arc. Compare each component's version with the fixed versions in Microsoft's advisory. Where the advisory says the fix is applied in the service, no local action may be needed, and the advisory should say so.
What to do now
- Open Microsoft's advisory for CVE-2026-69399 and note the affected components and fixed versions.
- List Arc enabled servers, clusters and services in your subscriptions.
- Update agents and extensions that the advisory names.
- Review who holds roles on Arc resources and remove unneeded access.
- Record the outcome so the item can be closed.
Why it matters
A confused deputy flaw is one where a trusted component can be tricked into using its own authority on behalf of someone who lacks it. Azure Arc connects outside machines and clusters into Azure's management plane, so it carries a lot of authority, and a flaw in that bridge matters more than in an ordinary agent.
The vector shows a changed scope, which means the impact can extend beyond the vulnerable component to other resources. The record has no further detail, and I will not guess. The CISA KEV flag is false and no exploitation is reported. A score of 10.0 should prompt a quick read of the advisory, because the right action may be an agent update, a service side change, or nothing for you to do.
Quick check
Is a score of 10.0 an emergency?
It is a reason to read the advisory today. The score says the vector is easy, and the advisory tells you whether you have anything to patch.
Which agent version is fixed?
I could not read that from Microsoft's page. Check the advisory.
Sources
- Microsoft Security Response Center entry (listed in the record; its page needs JavaScript, so I could not read build numbers from it)
- Gold record for CVE-2026-69399
Last reviewed: 19 October 2026.
