Executive brief
A security vulnerability exists in the Microsoft Azure Monitor Agent, a tool used to collect monitoring data from virtual machines and servers. An attacker who already has basic access to a system could exploit this flaw to gain higher-level administrative privileges. This could allow them to take full control of the affected machine, access sensitive data, or disrupt monitoring operations.
Technical details
A local privilege escalation vulnerability exists in the Microsoft Azure Monitor Agent due to improper validation of externally controlled file names or paths (CWE-73/CWE-610). An authenticated attacker with low-privileged local access can manipulate file system references used by the agent to execute code or perform actions with the higher privileges of the agent service. The vulnerability affects versions prior to 1.14.0. Successful exploitation grants the attacker full SYSTEM or root-level permissions on the host, depending on the operating system. Microsoft has released version 1.14.0 to address this issue.
Affected products
- Microsoft Azure Monitor Agent 1.0.0 up to (excluding) 1.14.0
Timeline
- 2026-05-12: disclosed: Initial disclosure by Microsoft
- 2026-05-12: advisory: MSRC advisory published
- 2026-06-18: patched: NVD updated with fix version 1.14.0 information