CVE-2026-100207
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
Improper neutralization of special elements used in an OS command ('OS command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.
Risk Assessment
An authenticated attacker can exploit command injection to execute arbitrary code on the host, potentially leading to privilege escalation and cloud environment compromise.
Recommendation
Apply security updates for Azure CycleCloud and restrict user permissions to the minimum necessary.
Other vulnerabilities in Azure CycleCloud
See all- CVE-2026-77909High
Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network.
- CVE-2026-70340High
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
- CVE-2026-65806Medium
Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network.
- CVE-2026-58279Medium
Azure CycleCloud has a missing authorization vulnerability, allowing an authorized attacker to elevate privileges over a network.
- CVE-2026-57969High
Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
- CVE-2024-43469High
Remote code execution vulnerability in Azure CycleCloud. Allows an attacker to execute code in the context of the application.
- CVE-2022-41085High
Elevation of privilege vulnerability in Azure CycleCloud. An attacker could exploit it to gain unauthorized privileges.
- CVE-2021-36943Medium
A vulnerability in Azure CycleCloud allows elevation of privilege. An attacker could exploit this flaw to gain higher privileges in the system.
- CVE-2021-33762High
Elevation of privilege vulnerability in Azure CycleCloud. An attacker could exploit it to gain higher privileges in the CycleCloud environment.
Original NVD description (English source)
Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS