MSRC-CVE-2026-21531 — Azure SDK for Python Remote Code Execution Vulnerability

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

How could an attacker exploit this vulnerability?
An attacker could supply a maliciously crafted continuation token that, when processed by the Azure AI Language Conversations Authoring SDK, triggers unsafe deserialization and executes attacker‑controlled code on the system using the SDK.

Security updates
1.0.0b4 — https://github.com/Azure/azure-sdk-for-python/blob/main/sdk/cognitivelanguage/azure-ai-language-conversations-authoring/CHANGELOG.md

Vulnerabilities 1

Critical 9.8

CVE-2026-21531 Public exploit

Azure SDK for Python Remote Code Execution Vulnerability

Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.

Microsoft Azure AI Language Authoring azure-ai-language-conversations-authoring PyPI

Feb 10, 2026

Revision history

2026-02-10 #1
Information published.

References

CVE-2026-21531 Azure SDK for Python Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21531
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss