CVE-2026-47299

Azure Monitor Agent (CVE-2026-47299) is a command injection vulnerability where the 'authorized attacker' qualifier is the critical detail most defenders are missing. This isn't a remote code execution flaw exposed to the internet — it's a trust boundary failure. The exploit requires an entity that already holds configuration-level access to the agent through Log Analytics workspaces, Data Collection Rules (DCRs), or Azure Policy assignments. That means the attack surface is your Azure configuration plane, not your network perimeter. The vulnerability lives in how the agent processes telemetry source definitions before they reach command construction. An attacker with permissions to create or modify Data Collection Rules or workspace configurations can inject malicious command elements that the agent executes during routine telemetry collection. The 'authorized' framing reveals Microsoft knows this requires legitimate Azure identity access — which makes this a supply-chain-class vulnerability where a single compromised subscription-level identity could push malicious configurations to every machine enrolled in that workspace. For defenders, your priority is identifying who holds MMA configuration permissions in your environment. Check Azure RBAC assignments for Log Analytics workspaces and DCRs — any user with Contributor or above on these resources can likely exploit this. Review existing Data Collection Rules for unexpected command-related parameters in data sources. The deployment model matters: if you use Azure Policy to push MMA extensions at scale, a compromised policy assignment becomes a mass compromise vector. The deeper problem is architectural. Azure Monitor Agent must execute system commands to collect WMI queries, parse logs, and read performance counters — that's its job. But an agent that legitimately runs commands must defensively parse every input from external configuration sources before those inputs reach command assembly. This is a trust boundary failure: Microsoft appears to have treated 'authorized' as synonymous with 'non-malicious,' an assumption that fails in any federated or multi-tenant Azure environment. Patch the agent immediately. Beyond that, treat your MMA configuration layer as a high-value attack surface — audit who can modify DCRs, limit workspace permissions to the minimum required identity, and consider whether the blast radius of a single configuration compromise across your telemetry fleet is acceptable risk for sensitive workloads.

Reviewed through automated stages and approved by a human before publication.