TI-2026-73253 Aliases CVE-2026-100207 GHSA-cj7w-cm7f-2rpj

OS command injection in Azure CycleCloud allows local code execution

LOW 34CWE-78Published 2026-10-13 · Updated 2026-10-31

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Azure CycleCloud is affected from 1.0.0 before 8.9.2. Improper neutralization of special elements used in an OS command (CWE-78) lets an authorized attacker run code locally. The attacker needs low privileges and a user must interact with the system. The CVSS vector rates the impact to confidentiality, integrity and availability as high.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00442 38th percentileScored 2026-11-07

Fix Fixed Azure CycleCloud 8.9.1 (Microsoft): 8.9.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Azure CycleCloud 8.9.1	1.0.0 to before 8.9.2	8.9.2	Patch available	CNA

Azure CycleCloud 8.9.1 VendorMicrosoft Affected 1.0.0 to before 8.9.2 Fixed in 8.9.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:azure_cyclecloud::::::::	—	—	Microsoft

cpe:2.3:a:microsoft:azure_cyclecloud:*:*:*:*:*:*:*:* Versions — — ·Microsoft

Remediation

Microsoft fixes this in Azure CycleCloud 8.9.2, so update to version 8.9.2.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Azure CycleCloud 8.9.1 (Microsoft) Fixed in 8.9.2

Timeline

2026-10-13 Threatist record created from CVE-2026-100207
2026-10-13 Alias added: GHSA-cj7w-cm7f-2rpj
2026-10-14 CISA SSVC decision points changed
2026-10-14 Priority changed: MEDIUM → LOW
2026-10-16 Affected versions changed · CNA

References

Patch 1

Azure CycleCloud Remote Code Execution Vulnerability

TI-2026-42212 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-37256 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-26194 Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2026-16982 Microsoft SharePoint Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-36863 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2025-33671 Microsoft SharePoint Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8

See all 18045 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences