Microsoft has disclosed CVE-2026-62830, a critical elevation of privilege vulnerability in the Azure SRE Agent. With a CVSS 3.1 base score of 9.9, the flaw is defined by a Scope Changed (S:C) vector — the mechanic that drives the severity, because it lets an attacker bypass the agent’s security boundary and reach resources across the broader infrastructure it manages.
The Azure SRE Agent is an autonomous, AI-powered service that executes runbooks, modifies infrastructure, and responds to incidents. It operates using tenant-scoped managed identities. The vulnerability, categorized under CWE-862: Missing Authorization, stems from a failure in the agent’s on-behalf-of (OBO) elevation flow. Breaking the authority-enforcement boundary of this flow allows unauthorized privilege escalation — on an agent that can execute runbooks and modify infrastructure.
Because the Azure SRE Agent is tagged as an exclusively-hosted service in the NVD record, there is no customer-side patch. Microsoft has implemented a service-side fix. Customer action: audit managed identity assignments, review RBAC configurations, and monitor for anomalous privilege elevation. No proof of concept has been published.
The vulnerability sits inside a pattern that has accelerated through the summer. ChatMate CVE-2026-32193 introduced Remote Prompt Execution — a new class where a single poisoned document becomes a bidirectional shell inheriting the victim’s identity, data, and cloud access through a five-stage chain. Langflow CVE-2026-9198 triggered a CISA emergency deadline (BOD 26-04, due today) after unauthenticated RCE was found in the platform’s default configuration. Unit 42 documented an autonomous attack campaign where threat actors selected DeepSeek specifically because its safety guardrails were weakest.
Confirmed alongside other critical updates during Black Hat USA 2026 as reported by SecurityWeek, CVE-2026-62830 is one of six vulnerabilities rated 9.9 or higher in Microsoft’s August batch. Three others — CVE-2026-63508, CVE-2026-56162, and CVE-2026-65667 — carry a maximum 10.0 rating.
The scope-change vector is what separates this from a standard privilege escalation. When the OBO flow breaks, the attacker inherits the agent’s service principal permissions across the managed environment. The blast radius extends beyond the agent to every infrastructure resource its managed identity can reach — runbooks, telemetry, incident tooling, and the Azure resources they touch.