CVE-2025-49692: Azure Connected Machine Agent Escalation

CVE-2025-49692 Overview

CVE-2025-49692 is an improper access control vulnerability [CWE-284] in the Microsoft Azure Connected Machine Agent for Windows. An authenticated local attacker can exploit this weakness to elevate privileges on the affected system. Microsoft published the advisory on September 9, 2025, and assigned the issue a CVSS 3.1 base score of 7.8.

The vulnerability affects the Azure Windows Virtual Machine Agent, a component that enables non-Azure servers to be managed through Azure Arc. Successful exploitation grants attackers higher privileges on the local host, compromising confidentiality, integrity, and availability.

Critical Impact
A low-privileged local user can elevate to SYSTEM-level privileges on Windows hosts running the affected Azure Connected Machine Agent, enabling full compromise of the endpoint.

Affected Products

Microsoft Azure Connected Machine Agent (Windows)
Azure Arc-enabled servers running the vulnerable agent build
Windows Virtual Machines managed via the Azure VM Agent

Discovery Timeline

2025-09-09 - CVE-2025-49692 published to NVD
2025-09-09 - Microsoft publishes security advisory
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49692

Vulnerability Analysis

The vulnerability resides in the Azure Connected Machine Agent, which runs with elevated privileges on Windows hosts to facilitate management operations between the endpoint and Azure Arc. Improper access control [CWE-284] within the agent's local components allows an authenticated user with limited rights to perform actions reserved for privileged accounts.

Exploitation requires local access and prior authentication to the target system. The attack complexity is low and does not require user interaction. Once exploited, the attacker gains the ability to execute code or modify system resources in the security context of the agent, which typically runs as SYSTEM.

Root Cause

The root cause is improper enforcement of access control checks on resources or operations managed by the Azure Connected Machine Agent. Microsoft has not published low-level technical details, but the CWE-284 classification indicates that the agent fails to properly restrict access to sensitive functionality or files based on the requester's privilege level. Common patterns in this class of vulnerability include insecure file or registry permissions, unquoted service paths, or writable directories used by privileged processes.

Attack Vector

Exploitation is local, meaning the attacker must already possess valid credentials on the target host. The attacker leverages the misconfigured access control to abuse a resource used by the privileged agent process. Refer to the Microsoft Security Update CVE-2025-49692 advisory for vendor-supplied technical context.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-49692

Indicators of Compromise

Unexpected child processes spawned by the Azure Connected Machine Agent service (GCArcService, himds.exe, or related binaries) running as SYSTEM.
New or modified files in agent-controlled directories under %ProgramFiles%\AzureConnectedMachineAgent\ or %ProgramData%\AzureConnectedMachineAgent\ initiated by low-privileged users.
Local privilege escalation events where a standard user account subsequently performs SYSTEM-context actions.

Detection Strategies

Monitor process creation events (Windows Event ID 4688, Sysmon Event ID 1) for privileged child processes launched by the agent.
Baseline the expected behavior of the Azure Connected Machine Agent and alert on deviations, such as unexpected command-line arguments or file writes.
Correlate authentication events with subsequent privilege escalation indicators on hosts running the agent.

Monitoring Recommendations

Enable file integrity monitoring on the agent installation directory and configuration files.
Track the installed agent version across the fleet and alert when hosts fall behind Microsoft's patched build.
Ingest Windows security and Sysmon logs into a centralized analytics platform to identify cross-host exploitation patterns.

How to Mitigate CVE-2025-49692

Immediate Actions Required

Inventory all Windows hosts running the Azure Connected Machine Agent, including Azure Arc-enabled servers and on-premises systems.
Apply the security update referenced in the Microsoft advisory to all affected systems as soon as possible.
Restrict local logon rights on servers running the agent to reduce the population of accounts capable of exploiting the flaw.

Patch Information

Microsoft released a fixed version of the Azure Connected Machine Agent alongside the September 9, 2025 advisory. Administrators should update to the latest agent build documented in the Microsoft Security Update CVE-2025-49692 guidance. Azure Arc-enabled machines may receive the update automatically if automatic upgrades are enabled; otherwise, deploy the update through your configuration management platform.

Workarounds

No official workaround has been published by Microsoft; patching is the required remediation.
Enforce the principle of least privilege on affected hosts and remove unnecessary local user accounts.
Enable Azure Arc automatic agent upgrade to ensure future security updates are applied without delay.

bash

# Verify installed Azure Connected Machine Agent version on Windows
& "C:\Program Files\AzureConnectedMachineAgent\azcmagent.exe" version

# Trigger a manual upgrade check via PowerShell (Azure Arc-enabled servers)
Get-Service -Name himds
Restart-Service -Name himds