微软披露 Azure SRE Agent 存在 CVSS 9.9 的缺失授权漏洞

Back to incident tracker

2026-08-06

HighVendor post

Microsoft Discloses CVSS 9.9 Missing-Authorization Vulnerability in Azure SRE Agent

Analysis of CVE-2026-62830, a critical CVSS 9.9 missing-authorization vulnerability that allows an authorized attacker to elevate privileges over a network.

Azure SRE AgentCredential exposureMissing authorization enabling network-based elevation of privilegeAzure SRE Agent authorization boundary

What happened

An authorized network attacker exploits missing authorization in Azure SRE Agent to elevate privileges.

Why it matters

Privilege escalation within the affected Azure SRE Agent authorization boundary; Microsoft rates the maximum impact critical.

Missing authorization check

Action-specific confirmation that the caller is authorized for the exact elevated operation requested.

Would PP block it?

Even if the vulnerable service grants elevated capability, a protected downstream action would still require a receipt binding the caller, resource, operation, and approved scope.

Incident analysis

Timeline and technical read

Timeline

1. 2026-08-06

   Microsoft formally discloses CVE-2026-62830 with a CVSS v3.1 base score of 9.9 as part of August Patch Tuesday.

2. 2026-08-06

   CrowdStrike and Cisco Talos include the critical Azure SRE Agent issue in their Patch Tuesday analyses.

Technical breakdown

• The vulnerability is categorized as missing authorization in Azure SRE Agent.
• Exploitation requires an authorized attacker and is reachable over a network.
• Successful exploitation elevates privileges beyond the attacker's intended authorization.
• Microsoft's public summary does not disclose the request shape or internal component responsible.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Credential exposure. The relevant Permission Protocol gate is Credential Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at

Azure SRE Agent privileged-operation boundary

Still needs

The public advisories do not disclose enough implementation detail to identify the exact faulty authorization check.

Receipt required for

Performing privileged operations through Azure SRE Agent

A Credential Gate can require the caller's authorized scope to match the exact privileged operation before it executes.

Start small

Put the relevant gate at this action boundary.

This incident maps to Credential Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop