CVE-2022-38007

Azure Guest Configuration and Azure Arc-enabled servers Elevation of Privilege Vulnerability

High7.8EPSS 0.69%

Published: 13 Sept 2022
Updated: 11 Mar 2025
Reserved: 8 Aug 2022
Assigned by: microsoft

Description

Azure Guest Configuration and Azure Arc-enabled servers Elevation of Privilege Vulnerability

Scores

CVSS scores of CVE-2022-38007, by who scored it
Scored by	CVSS	Score	Vector
microsoftCNA (assigner)	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
NVDNVD · Modified	3.1	High7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 0.69% · top 47% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.

Weakness

Elevation of Privilege

Affected products

Microsoft · Azure Guest Configuration
- affected 1.0 – < V1.21
Microsoft · Azure ARC
- affected 1.0.0 – < 1.22

References (2)

Azure Guest Configuration and Azure Arc-enabled servers Elevation of Privilege Vulnerability (opens in a new tab)vendor-advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-38007 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-38007](https://trackcve.app/badge/CVE-2022-38007.svg)](https://trackcve.app/cve/CVE-2022-38007)

Record last updated 11 Mar 2025, 16:10 UTC.