Product:
Azure Monitor Agent
Summary
Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. This vulnerability can be exploited by users with low privileges to gain higher access levels. The issue arises from improper handling of search paths, which can lead to unauthorized actions.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2026-42830 |
Exploitation
To exploit this vulnerability, an attacker with local access must manipulate the search path used by the Azure Monitor Agent. By placing a malicious executable in a location that the agent searches, the attacker can execute arbitrary code with elevated privileges. This requires minimal user interaction and can be performed by any authorized user on the system.
Affected Products
- Azure Monitor Agent: A monitoring tool that collects and analyzes telemetry data from various sources.
Mitigation
To mitigate this vulnerability, users should ensure that the Azure Monitor Agent is updated to the latest version. Additionally, implementing strict access controls and monitoring for unauthorized changes to the search paths can help prevent exploitation. Regular security audits and user training on privilege management are also recommended.