Publicly accessible Azure VM with high or critical vulnerabilities has an assigned managed identity that can escalate privileges to obtain administrator-equivalent RBAC rights

azure.compute

Description

A publicly accessible Azure VM has one or more open high or critical severity vulnerabilities and an assigned managed identity that can escalate privileges to obtain administrator-equivalent Azure RBAC rights at the tenant root, a management group, or a subscription. If the VM is compromised, an attacker could use the associated managed identity to escalate privileges and control resources and security settings within that scope.

Remediation

  1. Apply security updates to remediate the vulnerability and restrict public network access to the virtual machine. See Guest updates and host maintenance and Azure network security groups.
  2. Remove unnecessary privilege-escalation permissions from the managed identity and grant only the permissions required by the workload. See Remove Azure role assignments.