Read the docs
TI-2024-19112 Aliases CVE-2024-28917GHSA-3g3p-3q57-722m

Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege Vulnerability

Priority LOW 29CWE-284Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from Microsoft.

Summary

Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege Vulnerability

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00888 59th percentileScored 2026-11-07
Fix Fixed Azure Arc Extension (Microsoft): 1.2.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftAzure Arc Extension1.0.0 to before 1.2.61.2.6Patch availableCNA
  • Azure Arc Extension VendorMicrosoft Affected 1.0.0 to before 1.2.6 Fixed in 1.2.6 Patch available CNA

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:azure_arc_extension_microsoft.azstackhci.operator:*:*:*:*:*:*:*:*1.0.0 to before 5.0.5VulnerableMicrosoft
cpe:2.3:a:microsoft:azure_arc_extension_microsoft.azure.hybridnetwork:*:*:*:*:*:*:*:*1.0.0 to before 1.0.2620-162VulnerableMicrosoft
cpe:2.3:a:microsoft:azure_arc_extension_microsoft.azurekeyvaultsecretsprovider:*:*:*:*:*:*:*:*1.0.0 to before 1.5.2VulnerableMicrosoft
cpe:2.3:a:microsoft:azure_arc_extension_microsoft.iotoperations.mq:*:*:*:*:*:*:*:*before 0.3.0-previewVulnerableMicrosoft
cpe:2.3:a:microsoft:azure_arc_extension_microsoft.networkfabricserviceextension:*:*:*:*:*:*:*:*1.0.0 to before 5.1.3VulnerableMicrosoft
cpe:2.3:a:microsoft:azure_arc_extension_microsoft.openservicemesh:*:*:*:*:*:*:*:*1.0.0 to before 1.2.6VulnerableMicrosoft
cpe:2.3:a:microsoft:azure_arc_extension_microsoft.videoindexer:*:*:*:*:*:*:*:*1.0.0 to before 1.1.2VulnerableMicrosoft
  • cpe:2.3:a:microsoft:azure_arc_extension_microsoft.azstackhci.operator:*:*:*:*:*:*:*:* Versions 1.0.0 to before 5.0.5 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:azure_arc_extension_microsoft.azure.hybridnetwork:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.0.2620-162 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:azure_arc_extension_microsoft.azurekeyvaultsecretsprovider:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.5.2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:azure_arc_extension_microsoft.iotoperations.mq:*:*:*:*:*:*:*:* Versions before 0.3.0-preview Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:azure_arc_extension_microsoft.networkfabricserviceextension:*:*:*:*:*:*:*:* Versions 1.0.0 to before 5.1.3 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:azure_arc_extension_microsoft.openservicemesh:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.2.6 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:azure_arc_extension_microsoft.videoindexer:*:*:*:*:*:*:*:* Versions 1.0.0 to before 1.1.2 Vulnerable ·Microsoft

Remediation

  • Fix · CNA Azure Arc Extension (Microsoft) Fixed in 1.2.6

Vendor assessments

Microsoft

Microsoft's page for this CVE →

Impact
Elevation of Privilege
Exploited
No
Publicly disclosed
No
Exploitability
Exploitation Unlikely
ProductStatusPlan or fix
Azure Arc Cluster microsoft.azstackhci.operator ExtensionFixed 5.0.5 · Security Update
Azure Arc Cluster microsoft.azure.hybridnetwork ExtensionFixed 1.0.2620-162 · Security Update
Azure Arc Cluster microsoft.azurekeyvaultsecretsprovider ExtensionFixed 1.5.2 · Security Update
Azure Arc Cluster microsoft.iotoperations.mq ExtensionFixed 0.3.0-preview · Security Update
Azure Arc Cluster microsoft.networkfabricserviceextension ExtensionFixed 5.1.3 · Security Update
Azure Arc Cluster microsoft.openservicemesh ExtensionFixed 1.2.6 · Security Update
Azure Arc Cluster microsoft.videoindexer ExtensionFixed 1.1.2 · Security Update

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-28917
  2. 2026-10-03 Alias added: GHSA-3g3p-3q57-722m

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences