Microsoft patches critical Azure SRE Agent privilege escalation flaw

Microsoft has addressed a critical security vulnerability in its Azure Site Recovery (SRE) Agent that allows for remote privilege escalation. The flaw, identified as CVE-2026-69435, stems from a missing authorization check that enables an attacker with existing network access to elevate their privileges.

The National Vulnerability Database (NVD) has assigned the vulnerability a CVSS score of 9.6, categorizing it as CRITICAL. According to the NVD record, the weakness is classified under CWE-918, indicating a server-side request forgery or similar server-side processing error, though the Microsoft advisory specifically describes the impact as missing authorization. The flaw affects the Microsoft Azure SRE Agent, a component used for disaster recovery and migration scenarios in Azure environments.

Technical Context and Severity

The severity of this issue is driven by the ease of exploitation and the significant impact on system integrity. An attacker who is already authorized within the network can exploit the missing authorization control to gain higher-level access. This elevation of privilege occurs over the network, meaning the attacker does not need physical access to the compromised systems.

Microsoft’s Security Update Guide lists the vulnerability summary as "Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network." This phrasing suggests that the initial foothold requires some level of prior authorization, but the subsequent step bypasses necessary security checks to gain further control. The high CVSS score reflects the potential for an attacker to take full control of the agent's functions or the underlying system.

Affected Systems and Scope

The primary target of this vulnerability is the Microsoft Azure SRE Agent. Organizations utilizing Azure Site Recovery for workload replication and failover are the most likely to be affected. The vulnerability specifically impacts the agent software installed on virtual machines or physical servers that are being protected or migrated via Azure.

Because the attack vector is network-based and requires an authorized attacker, the threat landscape is focused on internal threats or attackers who have already breached the perimeter. However, the critical nature of the privilege escalation means that once the initial access is gained, the attacker can rapidly expand their reach within the environment. There is no indication in the source material that other Azure services or agents are affected by this specific CVE.

What should you do?

Security teams should verify the status of their Azure SRE Agents and ensure they are running the latest patched versions provided by Microsoft. Organizations should review access logs for any unusual privilege escalation attempts or unauthorized administrative actions originating from SRE Agent processes.