cve 2026 21224

CVE-2026-21224 is an elevation-of-privilege vulnerability in the Azure Connected Machine Agent (azcmagent) used by Azure Arc-enabled servers. Microsoft's advisory warns that a local, low-privileged attacker could exploit this flaw to escalate to SYSTEM or root on managed servers, potentially abusing machine-assigned identities and extension management to access Azure resources. This tag covers discussions about the vulnerability's impact, mitigation steps, and related security advisories for Windows and hybrid cloud environments.