Unauthorized Azure Arc Token Access

Danny Y@zendannyy

•updated Apr 24, 2026•5•0•293

Detects unauthorized processes attempting to access or interact with the dynamically generated Azure Arc identity token .key files. These files reside in a protected directory and are limited to SYSTEM-level ARC agent processes (CVE-2026-26117)