CVE-2026-113822: Azure CycleCloud Elevation of Privilege Vulnerability

Q: Who can exploit this vulnerability?

An attacker must already be authorized to access Azure CycleCloud. Exploitation can be performed over a network and does not require user interaction.

Q: What is the potential impact if exploitation succeeds?

A successful attacker can elevate privileges in Azure CycleCloud. The reported impact includes high confidentiality impact, while integrity and availability impact are listed as none.

Q: Is this exploitable without valid access to the affected environment?

No. The attack requirements indicate low privileges are required, so an unauthenticated attacker is not described as able to exploit this issue.

Published Nov 10, 2026

Updated

Azure CycleCloud Elevation of Privilege Vulnerability

Other sources

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft Azure CycleCloud=8.9.1, >=8.10<8.10.1-3968

8.10.1-3968

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 8.10.1-3968

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:17 PM

Data Sourced

via MITRE·06:17 PM

DescriptionSeverity

Data Sourced

via NVD·07:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must already be authorized to access Azure CycleCloud. Exploitation can be performed over a network and does not require user interaction.

What is the potential impact if exploitation succeeds?

A successful attacker can elevate privileges in Azure CycleCloud. The reported impact includes high confidentiality impact, while integrity and availability impact are listed as none.

Is this exploitable without valid access to the affected environment?

No. The attack requirements indicate low privileges are required, so an unauthenticated attacker is not described as able to exploit this issue.

CVE-2026-113822: Azure CycleCloud Elevation of Privilege Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What is the potential impact if exploitation succeeds?

Is this exploitable without valid access to the affected environment?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What is the potential impact if exploitation succeeds?

Is this exploitable without valid access to the affected environment?