MSRC-CVE-2026-21529 — Azure HDInsight Spoofing Vulnerability

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

Details

According to the CVSS metric, user interaction is required (UI:R) and privileges required is Low (PR:L). What does that mean for this vulnerability?
An authorized attacker with privileges could send controlled inputs to exploit this vulnerability.

What additional customer action is needed to be protected?
The customer action needed is to restart Ambari server in both of the head nodes to have this fix updated.

Security updates
5.1 — https://docs.azure.cn/en-us/hdinsight/hdinsight-release-notes

Vulnerabilities 1

Medium 5.7

CVE-2026-21529

Azure HDInsight Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an authorized attacker to perform spoofing over a network.

Microsoft Azure HDInsight

Feb 10, 2026

Revision history

2026-02-10 #1
Information published.

References

CVE-2026-21529 Azure HDInsight Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21529
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss