🟠 High | Source: Microsoft Security Response Center
CVE-2026-12080 is a local privilege escalation vulnerability in the QEMU guest agent, specifically affecting the ‘guest-ssh-add-authorized-keys’ functionality. An attacker with local access inside a virtual machine can exploit a symlink attack to write files to arbitrary locations, potentially gaining elevated privileges on the host or within the guest. This is relevant to Azure environments where QEMU-KVM underpins virtualisation infrastructure.
Security Architect’s Take: Assess whether your Azure or self-managed VM infrastructure exposes the QEMU guest agent and apply vendor patches promptly. Review least-privilege controls for guest agent interactions and consider restricting or disabling the SSH authorised keys feature of the guest agent if it is not operationally required.
Original advisory: CVE-2026-12080 Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys