CVE-2026-109457: Azure CLI Remote Code Execution Vulnerability

Q: What level of access and user involvement does exploitation require?

The vector indicates low privileges are required (PR:L) and user interaction is required (UI:R). The description also characterizes the attacker as authorized and able to act over a network.

Q: Which product is identified as affected?

The software field identifies Microsoft Azure Machine Learning from Microsoft. The record title refers to Azure CLI, but the provided data does not resolve that discrepancy or identify specific affected components.

Q: Are affected versions, fixed versions, or workarounds provided?

No affected version range, fixed version, patch guidance, or workaround is included in the provided data.

Published Nov 10, 2026

Updated

Azure CLI Remote Code Execution Vulnerability

Other sources

Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network.

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft Azure Machine Learning<2.45.1

2.45.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.45.1

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:15 PM

Data Sourced

via MITRE·06:15 PM

DescriptionSeverity

Data Sourced

via NVD·07:18 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access and user involvement does exploitation require?

The vector indicates low privileges are required (PR:L) and user interaction is required (UI:R). The description also characterizes the attacker as authorized and able to act over a network.

Which product is identified as affected?

The software field identifies Microsoft Azure Machine Learning from Microsoft. The record title refers to Azure CLI, but the provided data does not resolve that discrepancy or identify specific affected components.

Are affected versions, fixed versions, or workarounds provided?

No affected version range, fixed version, patch guidance, or workaround is included in the provided data.

CVE-2026-109457: Azure CLI Remote Code Execution Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access and user involvement does exploitation require?

Which product is identified as affected?

Are affected versions, fixed versions, or workarounds provided?

Company

Resources

Contact

Frequently Asked Questions

What level of access and user involvement does exploitation require?

Which product is identified as affected?

Are affected versions, fixed versions, or workarounds provided?