Skip to content
OpenAdvisories
High MSRC-CVE-2026-100207 1 CVE

Azure CycleCloud Remote Code Execution Vulnerability

Published Oct 13, 2026 · Updated Oct 13, 2026

Vendor: Microsoft

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

Does an attacker need to be authenticated to exploit this vulnerability?
An attacker must be authenticated to Azure CycleCloud and have permission to create or manage a cluster and configure a Windows node's credentials. A different user must then use the Azure CycleCloud CLI from a macOS or Linux workstation to connect to the affected node.

Security updates
8.9.2 — https://learn.microsoft.com/en-us/azure/cyclecloud/release-notes/8-9-2?view=cyclecloud-8

Vulnerabilities 1

  • High 7.3
    CVE-2026-100207

    Azure CycleCloud Remote Code Execution Vulnerability

    Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.

    Microsoft Azure CycleCloud 8.9.1

Revision history

  1. #1

    Information published.

References