Azure Arc Machine with Vulnerable Agent Version

Aitor Fernández@aitorsbio

•updated Mar 25, 2026•11•3•472

This rule identifies Azure Arc-enabled machines running agent versions older than 1.61, which are potentially vulnerable to CVE-2026-26117. It queries Azure Activity logs to extract agent versions and flags machines with outdated agents.