CVE-2026-81349
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk61th percentile - higher than 61% of all known CVEs
Summary
Improper neutralization of special elements used in an os command ('os command injection') in Azure HDInsights allows an authorized attacker to elevate privileges over a network.
Risk Assessment
An authorized user could escalate privileges, potentially leading to unauthorized access to data and cloud resources.
Recommendation
Apply vendor patches and restrict user privileges in Azure HDInsights.
Related vulnerabilities
- CVE-2026-93680Critical
IBM Langflow OSS versions 1.0.0 through 1.12.8 contain an improper authentication flaw that could allow a remote attacker to bypass security restrictions.
- CVE-2026-90868Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain an OS command injection vulnerability that could allow arbitrary command execution under certain configurations.
- CVE-2026-90866Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a path traversal vulnerability that could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution.
- CVE-2026-90865Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain an OS command injection vulnerability that could allow arbitrary command execution with elevated privileges under certain configurations.
- CVE-2026-90864Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows contain a path traversal vulnerability that could allow a delegated Host Administrator to access or modify files outside their authorized scope.
- CVE-2026-90863Critical
Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows have missing authorization in the administrative interface that could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling arbitrary command execution with elevated privileges and complete compromise of the underlying server.
- CVE-2026-84295Critical
Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows contain an improper authentication flaw that could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.
- CVE-2026-62131Critical
Zoho Flow versions up to and including 2.14.5 contain an unauthenticated PHP Object Injection vulnerability that could allow an attacker to manipulate objects within the application.
- CVE-2026-62018Critical
Gunslinger versions up to and including 1.11 contain an unauthenticated PHP Object Injection vulnerability that could allow an attacker to manipulate objects within the application.
- CVE-2026-62017Critical
Good Homes versions up to and including 1.3.13 contain an unauthenticated PHP Object Injection vulnerability that could allow an attacker to manipulate objects within the application.
Original NVD description (English source)
Improper neutralization of special elements used in an os command ('os command injection') in Azure HDInsights allows an authorized attacker to elevate privileges over a network.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS