CVE-2026-81349: Azure HDInsight Ambari Elevation of Privilege Vulnerability
Published Sep 8, 2026
·Updated
Azure HDInsight Ambari Elevation of Privilege Vulnerability
Other sources
Improper neutralization of special elements used in an os command ('os command injection') in Azure HDInsights allows an authorized attacker to elevate privileges over a network.
— Microsoft
Affected Software
2 affected componentsFixes available
Microsoft Azure HDInsight Ambari
Microsoft Azure HDInsight<2606012120
2606012120
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2606012120
Event History
Sep 8, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·02:00 PM
Description
CVE Published
via MITRE·05:13 PM
Data Sourced
via MITRE·05:13 PM
DescriptionSeverity
Frequently Asked Questions
1
Which deployments should be included in the exposure review?
Review Microsoft Azure HDInsight Ambari and Microsoft Azure HDInsight deployments.
2
What level of access does an attacker need to exploit this issue?
The issue requires an authorized attacker and can be exploited over a network. No user interaction is required.