CVE-2026-102224: Azure CycleCloud Elevation of Privilege Vulnerability

Q: Who is exposed to exploitation?

Azure CycleCloud deployments are affected where an attacker already has authorization and can reach the service over the network. The issue is not described as exploitable by an unauthenticated attacker.

Q: What does an attacker need to do to exploit this issue?

The attacker needs authorized access and network access to Azure CycleCloud, then must induce a user interaction. The vulnerability involves OS command injection and can allow privilege elevation.

Q: What is the potential impact after successful exploitation?

A successful attacker may elevate privileges, with high impacts to confidentiality, integrity, and availability. The scope is changed, indicating the impact can extend beyond the initially vulnerable security authority.

Published Nov 10, 2026

Updated

Azure CycleCloud Elevation of Privilege Vulnerability

Other sources

Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft Azure CycleCloud=8.9.1, >=8.10<8.10.1

8.10.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.10.1

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeakness

Data Sourced

via Microsoft·04:00 PM

Affected Software

CVE Published

via MITRE·06:15 PM

Data Sourced

via MITRE·06:15 PM

DescriptionSeverity

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to exploitation?

Azure CycleCloud deployments are affected where an attacker already has authorization and can reach the service over the network. The issue is not described as exploitable by an unauthenticated attacker.

What does an attacker need to do to exploit this issue?

The attacker needs authorized access and network access to Azure CycleCloud, then must induce a user interaction. The vulnerability involves OS command injection and can allow privilege elevation.

What is the potential impact after successful exploitation?

A successful attacker may elevate privileges, with high impacts to confidentiality, integrity, and availability. The scope is changed, indicating the impact can extend beyond the initially vulnerable security authority.

CVE-2026-102224: Azure CycleCloud Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to exploitation?

What does an attacker need to do to exploit this issue?

What is the potential impact after successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

What does an attacker need to do to exploit this issue?

What is the potential impact after successful exploitation?