CyberICT

CVE-2026-100207

Microsoft · Published October 13, 2026

CVSS v3.1

HIGH
Patch availableGet patch

Description

Azure CycleCloud Remote Code Execution Vulnerability. Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.

Affected Products

  • Azure CycleCloud 8.9.2
  • Azure CycleCloud 8.9.1

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C