CVE-2026-100207: Azure CycleCloud Remote Code Execution Vulnerability

Q: Who is exposed to this vulnerability?

Azure CycleCloud deployments are affected, including the listed Azure CycleCloud 8.9.1 and 8.9.2 versions. Exploitation requires an authorized attacker with local access.

Q: What access does an attacker need to exploit it?

The attacker must already be authorized and have local access to the affected Azure CycleCloud environment. User interaction is also required according to the supplied severity vector.

Q: What is the potential impact of successful exploitation?

A successful attacker can execute code locally. The severity vector indicates high potential impact to confidentiality, integrity, and availability.

Published Oct 13, 2026

Updated

Azure CycleCloud Remote Code Execution Vulnerability

Other sources

Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.

— Microsoft

Affected Software

3 affected componentsFixes available

Microsoft Azure Cyclecloud

Microsoft Azure CycleCloud 8.9.1<8.9.2

8.9.2

Microsoft Azure CycleCloud 8.9.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.9.2

Event History

Oct 13, 2026

CVE Published

via Microsoft·02:00 PM

Data Sourced

via Microsoft·02:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·07:01 PM

Data Sourced

via MITRE·07:01 PM

DescriptionSeverity

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this vulnerability?

Azure CycleCloud deployments are affected, including the listed Azure CycleCloud 8.9.1 and 8.9.2 versions. Exploitation requires an authorized attacker with local access.

What access does an attacker need to exploit it?

The attacker must already be authorized and have local access to the affected Azure CycleCloud environment. User interaction is also required according to the supplied severity vector.

What is the potential impact of successful exploitation?

A successful attacker can execute code locally. The severity vector indicates high potential impact to confidentiality, integrity, and availability.

CVE-2026-100207: Azure CycleCloud Remote Code Execution Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this vulnerability?

What access does an attacker need to exploit it?

What is the potential impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What access does an attacker need to exploit it?

What is the potential impact of successful exploitation?