Executive Summary
A critical vulnerability identified as CVE-2026-26117 exists in the Microsoft Azure Arc agent for Windows (versions prior to 1.61). The flaw stems from a race condition caused by the 'Delayed Start' configuration of core services—HIMDS, Guest Configuration, and ARC Proxy—combined with the use of unencrypted HTTP for sensitive internal communications.
By pre-binding to specific local ports (40342) or named pipes during a system reboot, a low-privileged attacker can intercept service requests and spoof metadata responses. This allows the attacker to coerce system-level services into disclosing sensitive authentication tokens or redirecting the machine to an attacker-controlled Azure tenant. The impact includes full local SYSTEM privileges and the ability to leverage the machine's Azure RBAC permissions to pivot into cloud environments or disable security controls like Microsoft Defender for Endpoint.