Read the docs
TI-2026-72886 Aliases CVE-2026-88094GHSA-mv49-99p5-ffp9

Injection in Azure Storage Library allows privilege elevation

Priority LOW 39CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

The azure-storage-blob-batch package from 1.0.0 before 12.31.2 and Microsoft Edge (Chromium-based) from 1.0.0.0 before 153.0.4234.46 are affected. Improper neutralization of special elements in output used by a downstream component (CWE-74) lets an authorized attacker over the network gain higher privileges. The attacker needs low privileges and no user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0082 57th percentileScored 2026-11-07
Fix Fixed azure-storage-blob-batch (Microsoft): 12.31.2Microsoft Edge (Chromium-based) (Microsoft): 153.0.4234.46

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Microsoftazure-storage-blob-batch1.0.0 to before 12.31.212.31.2Patch availableCNA
MicrosoftMicrosoft Edge (Chromium-based)1.0.0.0 to before 153.0.4234.46153.0.4234.46Patch availableCNA
  • azure-storage-blob-batch VendorMicrosoft Affected 1.0.0 to before 12.31.2 Fixed in 12.31.2 Patch available CNA
  • Microsoft Edge (Chromium-based) VendorMicrosoft Affected 1.0.0.0 to before 153.0.4234.46 Fixed in 153.0.4234.46 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:azure-storage-blob-batch:*:*:*:*:*:java:*:*before 12.31.2VulnerableMicrosoft
cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:-:*:*:*before 153.0.4234.46VulnerableMicrosoft
  • cpe:2.3:a:microsoft:azure-storage-blob-batch:*:*:*:*:*:java:*:* Versions before 12.31.2 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:edge_chromium:*:*:*:*:-:*:*:* Versions before 153.0.4234.46 Vulnerable ·Microsoft

Remediation

Update azure-storage-blob-batch to version 12.31.2 and Microsoft Edge (Chromium-based) to version 153.0.4234.46.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA azure-storage-blob-batch (Microsoft) Fixed in 12.31.2
  • Fix · CNA Microsoft Edge (Chromium-based) (Microsoft) Fixed in 153.0.4234.46

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-88094
  2. 2026-10-13 Alias added: GHSA-mv49-99p5-ffp9
  3. 2026-10-16 Fix available: Microsoft/[email protected] · CNA
  4. 2026-10-25 EPSS moved to the 50th–90th percentile
  5. 2026-10-29 Fix available: Microsoft/Microsoft Edge (Chromium-based)@153.0.4234.46 · CNA
  6. 2026-11-06 Affected versions changed · Red Hat
  7. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences