{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "SP with \u003ca href=\"https://consulting.withsecure.com/\"\u003eWithSecure Consulting\u003c/a\u003e"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2025-26627 Azure Arc Installer Elevation of Privilege Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26627"
      },
      {
        "category": "self",
        "summary": "CVE-2025-26627 Azure Arc Installer Elevation of Privilege Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2025/msrc_cve-2025-26627.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Azure Arc Installer Elevation of Privilege Vulnerability",
    "tracking": {
      "current_release_date": "2025-03-11T07:00:00.000Z",
      "generator": {
        "date": "2025-05-19T21:37:53.696Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2025-26627",
      "initial_release_date": "2025-03-11T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2025-03-11T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c1.0.10",
            "product": {
              "name": "Azure ARC \u003c1.0.10",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "1.0.10",
            "product": {
              "name": "Azure ARC 1.0.10",
              "product_id": "12068"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure ARC"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-26627",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.",
          "title": "What privileges could be gained by an attacker who successfully exploited this vulnerability?"
        },
        {
          "category": "faq",
          "text": "Only machines onboarded via Group Policy that have the GPO applied to them are affected.\nThe GPO name is \u0027[MSFT] Azure Arc Servers Onboarding\u0027 followed by a datetimestamp\ne.g. \u0027[MSFT] Azure Arc Servers Onboarding20250220113589\u0027\nUnassign and delete the previous Group Policy Object from the Group Policy Management Console (GPMC).\nDownload the new scripts from the Fixed agent proxy parameter release in the Github repository 1.0.10.\nRun the DeployGPO script as before using the same parameters.\nAssign the new Group Policy Object to your groups/domains/units.\nFor further information, please go to the Arc blade of Azure Portal and follow the instructions for GPO onboarding.\nOnly machines onboarded via Group Policy that have the GPO applied to them are affected\nThe GPO name is \u0027[MSFT] Azure Arc Servers Onboarding\u0027 followed by a datetimestamp\ne.g. \u0027[MSFT] Azure Arc Servers Onboarding20250220113589\u0027",
          "title": "How do I know if I\u0027m affected by this vulnerability?"
        },
        {
          "category": "faq",
          "text": "Successful exploitation of this vulnerability requires an attacker to carefully time their actions to exploit the timing differences in the execution of specific operations. They must accurately measure these timing variations to infer sensitive information or gain unauthorized access. This often involves sophisticated techniques to manipulate and observe the timing behavior of the target system.",
          "title": "According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?"
        }
      ],
      "product_status": {
        "fixed": [
          "12068"
        ],
        "known_affected": [
          "1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-26627 Azure Arc Installer Elevation of Privilege Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26627"
        },
        {
          "category": "self",
          "summary": "CVE-2025-26627 Azure Arc Installer Elevation of Privilege Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2025/msrc_cve-2025-26627.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2025-03-11T07:00:00.000Z",
          "details": "1.0.10:Security Update:https://github.com/Azure/ArcEnabledServersGroupPolicy/releases/tag/1.0.10",
          "product_ids": [
            "1"
          ],
          "url": "https://github.com/Azure/ArcEnabledServersGroupPolicy/releases/tag/1.0.10"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.0,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.1,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Elevation of Privilege"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely"
        }
      ],
      "title": "Azure Arc Installer Elevation of Privilege Vulnerability"
    }
  ]
}