GCVE-110-NCSC-2025-311

Advisory PublishedCVSS 7.0/10

Vulnetix · Advisory published October 14, 2025

An improper access control vulnerability in Azure Connected Machine Agent allows an authorized attacker to locally elevate their privileges.

Download JSON Open in Console

Weaknesses (CWE)

CWE-284Improper Access ControlCWE-73External Control of File Name or PathCWE-502Deserialization of Untrusted DataCWE-306Missing Authentication for Critical FunctionCWE-269Improper Privilege ManagementCWE-285Improper AuthorizationCWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Risk Scores

CVSS 3.1

7.0/10

High · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
Microsoft	vers:unknown/*	—	—

Aliases

CVE-2025-47989 CVE-2025-55321 CVE-2025-58724 CVE-2025-59218 CVE-2025-59246 CVE-2025-59247 CVE-2025-59271 CVE-2025-59285 CVE-2025-59291 CVE-2025-59292 CVE-2025-59494

References

advisory

Browse GCVE Records

74,267 records in the GCVE database · Updated July 22, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON