CVE-2026-100207: Azure CycleCloud Remote Code Execution Vulnerability

Overview

Severity

High (CVSS 7.3)

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Category

Remote Code Execution

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2026-Oct

Released

2026-10-13

Description

Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.

FAQ

Does an attacker need to be authenticated to exploit this vulnerability? An attacker must be authenticated to Azure CycleCloud and have permission to create or manage a cluster and configure a Windows node's credentials. A different user must then use the Azure CycleCloud CLI from a macOS or Linux workstation to connect to the affected node.

Affected Products (2)

Azure

• Azure CycleCloud 8.9.2
• Azure CycleCloud 8.9.1

Acknowledgments

XBREACH TEAM with <a href="https://xbreach.ai/">XBreach.ai</a>

Revision History

• 2026-10-13: Information published.