CVE-2026-26117

CVE-2026-26117 is an authentication bypass vulnerability in the Microsoft Arc Enabled Servers Azure Connected Machine Agent that allows a local, low-privileged attacker to achieve privilege escalation. Rated 7.8 High, this flaw has a local attack vector and low attack complexity, enabling an attacker to gain high impact on confidentiality, integrity, and availability without user interaction. While there is no known active exploitation, public exploit code, or KEV listing, the vulnerability has received limited community discussion and media coverage.