Vulnerability in Microsoft Arc Enabled Servers - Azure Connected Machine Agent

[ Description ]Official description

Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.

[ Fixes ]Fixes and patches

• Security bulletin: Microsoft Azure CVE-2026-69877Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69877, cited by CERT-FR CERTFR-2026-AVI-1315
• Security bulletin: Microsoft Azure CVE-2026-85891Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85891, cited by CERT-FR CERTFR-2026-AVI-1315
• Security bulletin: Microsoft Azure CVE-2026-88132Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88132, cited by CERT-FR CERTFR-2026-AVI-1315
• Security bulletin: Microsoft Azure CVE-2026-85922Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85922, cited by CERT-FR CERTFR-2026-AVI-1315
• Security bulletin: Microsoft Azure CVE-2026-100207Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-100207, cited by CERT-FR CERTFR-2026-AVI-1315
• Security bulletin: Microsoft Azure CVE-2026-85925Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-85925, cited by CERT-FR CERTFR-2026-AVI-1315
• Security bulletin: Microsoft Azure CVE-2026-96204Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96204, cited by CERT-FR CERTFR-2026-AVI-1315
• Security bulletin: Microsoft Azure CVE-2026-88094Vendor patch or bulletin · CERT-FR · msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88094, cited by CERT-FR CERTFR-2026-AVI-1315

[ Advisories ]Government CERT advisories

• CERT-FR14 Oct 2026CERTFR-2026-AVI-1315

  Multiple vulnerabilities in Microsoft Azure Translated from French

  Multiple vulnerabilities have been discovered in Microsoft Azure. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and a breach of data confidentiality.

  CVE-2026-88094CVE-2026-100207CVE-2026-88132+5 more CVEs
• BSI CERT-Bund13 Oct 2026WID-SEC-2026-3921

  Microsoft Azure: Multiple vulnerabilities Translated from German

  CVE-2026-88132CVE-2026-85891CVE-2026-100207+4 more CVEs
• NCSC-NL13 Oct 2026NCSC-2026-0421

  Vulnerabilities fixed in Microsoft Azure Translated from Dutch

  Probability/damage M/HCVE-2026-85922CVE-2026-85925CVE-2026-88132+9 more CVEs

[ References ]References

• msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96204