CVE-2025-47988

FAQ

What actions do customers need to take to protect themselves from this vulnerability?

Customers who have disabled Automatic Extension Upgrades or would like to upgrade an extension immediately must manually update their Azure Monitor Agent to the latest version. For more information on how to perform a manual update, see Manage Azure Monitor Agent.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation depends on the vulnerable troubleshooting script in the Azure monitoring agent on the victim’s machine being executed by the user in an on-premises environment.

According to the CVSS metric, the attack vector is adjacent (AV:A) and privilege required is none (PR:N). What is the target used in the context of the remote code execution?

An attacker within the same network subnet as the victim machine could take advantage of a vulnerability in the troubleshooting script of the Azure monitoring agent extension installed on it and perform remote code execution (RCE). By successfully exploiting this vulnerability, the attacker could run arbitrary code on the victim’s target machine.