MSRC-CVE-2026-109457 — Azure CLI Remote Code Execution Vulnerability

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An authenticated attacker with permission to submit jobs in a shared workspace could prepare a specially crafted job and convince another user to connect to it using Azure CLI. Successful exploitation could allow commands to run with that user's local permissions.

Security updates
2.45.1 — https://github.com/Azure/azure-cli-extensions/blob/main/src/machinelearningservices/CHANGELOG.rst

Vulnerabilities 1

High 8.0

CVE-2026-109457

Azure CLI Remote Code Execution Vulnerability

Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network.

Microsoft Azure Machine Learning

Nov 10, 2026

Revision history

2026-11-10 #1
Information published.

References

CVE-2026-109457 Azure CLI Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-109457
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss