Microsoft disclosed CVE-2026-40381 on May 12, 2026, as an Important-rated elevation-of-privilege vulnerability in the Azure Connected Machine Agent, the software component that lets Windows and Linux servers outside Azure be managed through Azure Arc. The immediate story is not a flashy wormable...
Microsoft’s advisory record for the CVE identifier you supplied (CVE‑2025‑47989) does not resolve to a public MSRC advisory; however, a confirmed elevation‑of‑privilege (EoP) defect in the Azure Connected Machine (Azure Arc / azcmagent) family has been published, tracked in vendor advisories and...