CVE-2026-70009 is a critical (CVSS 9.3) path traversal in Microsoft Azure Arc. Microsoft's record says an unauthorized attacker could elevate privileges over a network. I could not read the advisory page, so check it for the affected components and fixed versions before you act.
What's affected
- Product: Microsoft Azure Arc. The record does not name the Arc component.
- Weakness: CWE-22 path traversal, described as improper limitation of a pathname to a restricted directory.
- Severity: CVSS 3.1 9.3, vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N. No privileges or user action, with a changed scope. Integrity impact is high and confidentiality impact is low. - Fixed version: not confirmed. Microsoft's page needs JavaScript and did not load for me.
How to check if you're exposed
On an Arc enabled server, read the connected machine agent version:
azcmagent version
Then list your Arc enabled resources in the Azure portal and compare each component with the versions named in Microsoft's advisory. Microsoft released two Arc CVEs on the same date, CVE-2026-69399 and this one, so read the entries together.
What to do now
- Read Microsoft's advisory for CVE-2026-70009 and note the affected components and fixed versions.
- Inventory Arc enabled servers and other Arc resources.
- Update the agents and extensions that the advisory names.
- Review roles on Arc resources and remove access that is not needed.
- Record the result in your vulnerability register.
Why it matters
Path traversal happens when a program builds a file path from input and does not stop the path from leaving the intended folder. The vector for this CVE shows a high integrity impact and a low confidentiality impact, so the stated concern is writing or changing files, not reading them. That fits a path that is used for writing.
With a changed scope, the effect can extend beyond the component. The record has no more detail and the CISA KEV flag is false, with no exploitation reported. As with the other Arc entry, the first task is to read the advisory and learn whether the action is on your side.
Quick check
Is this related to CVE-2026-69399?
Both are listed against Azure Arc and were published the same day, but they have different weakness classes. The record does not link them.
Which version is fixed?
I could not read that from Microsoft's page. Check the advisory.
Sources
- Microsoft Security Response Center entry (listed in the record; its page needs JavaScript, so I could not read build numbers from it)
- Gold record for CVE-2026-70009
Last reviewed: 19 October 2026.
