CVE-2025-55316: Azure Connected Machine Agent Escalation

CVE-2025-55316 Overview

CVE-2025-55316 is a local privilege escalation vulnerability in the Microsoft Azure Connected Machine Agent, the component that onboards non-Azure servers into Azure Arc. The flaw stems from external control of a file name or path [CWE-73], allowing an authorized local attacker to manipulate file operations performed by the agent. Successful exploitation lets a low-privileged user elevate to higher privileges on the affected host, with full impact to confidentiality, integrity, and availability. Microsoft has published a security update addressing the issue.

Critical Impact
An authenticated local attacker can hijack file paths used by the Azure Connected Machine Agent to gain elevated privileges on Windows and Linux servers onboarded to Azure Arc.

Affected Products

Microsoft Azure Connected Machine Agent (Azure Arc-enabled servers)
Windows and Linux hosts onboarded to Azure Arc using the affected agent versions
Hybrid and multi-cloud environments managed through Azure Arc

Discovery Timeline

2025-09-09 - CVE-2025-55316 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55316

Vulnerability Analysis

The Azure Connected Machine Agent runs privileged services that extend Azure control plane capabilities to non-Azure servers. The vulnerability allows an authorized local attacker to influence file names or paths consumed by these privileged operations. Because the agent processes attacker-controllable path input during file handling, the attacker can redirect reads or writes to paths outside the intended scope. The result is code execution or file manipulation in the security context of the agent, which typically runs with elevated privileges.

The attack requires local access and low-level privileges but no user interaction. Exploitation yields high impact across confidentiality, integrity, and availability on the affected host.

Root Cause

The root cause is classified as [CWE-73] External Control of File Name or Path. The agent accepts or resolves file path input from a source that a lower-privileged user can influence, without sufficient canonicalization or validation. This enables path substitution attacks such as symbolic link redirection, directory traversal, or race conditions between path resolution and file access.

Attack Vector

An attacker who already holds a low-privilege local account on a server running the Azure Connected Machine Agent stages a controlled file, symlink, or directory that the agent will subsequently access. When the agent operates on that path with its elevated token, the attacker gains the ability to write to protected locations, replace privileged binaries, or read sensitive material. The vulnerability requires no network access and no interaction from another user.

Microsoft has not published exploitation details. Refer to the Microsoft Security Update CVE-2025-55316 advisory for authoritative technical guidance.

Detection Methods for CVE-2025-55316

Indicators of Compromise

Unexpected creation of symbolic links, junctions, or hard links within directories accessed by the Azure Connected Machine Agent (azcmagent, himds, gcarcservice, extensionservice).
File writes to protected system paths correlated with activity from Azure Arc agent processes.
New or modified files under agent working directories such as %ProgramData%\AzureConnectedMachineAgent\ on Windows or /var/opt/azcmagent/ on Linux originating from non-agent users.

Detection Strategies

Monitor process lineage for the Azure Arc agent services spawning shells, script interpreters, or unexpected child processes.
Alert on privilege transitions where a low-privileged user session precedes file operations executed under the agent's elevated context.
Baseline legitimate file paths the agent accesses and flag deviations, especially writes outside standard extension directories.

Monitoring Recommendations

Enable file integrity monitoring on Azure Arc agent installation and configuration directories.
Forward agent logs and Windows Security or Linux auditd events to a centralized data lake for correlation with authentication events.
Review Azure Arc extension installation activity to detect unauthorized extension deployments that could deliver the exploit payload.

How to Mitigate CVE-2025-55316

Immediate Actions Required

Update the Azure Connected Machine Agent to the fixed version published in the Microsoft Security Update CVE-2025-55316 advisory.
Inventory all Azure Arc-enabled servers using azcmagent show to confirm current agent versions before and after patching.
Restrict local logon rights on Arc-managed servers to reduce the pool of accounts capable of triggering the flaw.

Patch Information

Microsoft has released a security update for the Azure Connected Machine Agent. Consult the Microsoft Security Update CVE-2025-55316 advisory for the specific fixed agent version and download instructions. The agent supports automatic upgrades on supported platforms; verify that the automatic upgrade feature is enabled to receive future fixes.

Workarounds

No official workaround has been published; apply the vendor patch as the primary remediation.
Enforce least-privilege on Arc-managed hosts and remove unnecessary interactive user accounts.
Harden permissions on agent working directories to prevent non-administrative users from creating files, links, or junctions within them.

bash

# Verify Azure Connected Machine Agent version on a managed server
azcmagent show --json | grep -i agentVersion

# Linux: check for the running Arc agent services
systemctl status himdsd hybridagent gcad extd

# Windows PowerShell: confirm patched agent version
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Azure Connected Machine Agent" | Select-Object Version