CVE-2026-21529: Azure HDInsight Spoofing Vulnerability

Overview

Severity

Medium (CVSS 5.7)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

Category

Spoofing

Exploit Status

Not Exploited

Exploitation Likelihood

Unlikely

Patch Tuesday

2026-Feb

Released

2026-02-10

EPSS Score

0.04% (percentile: 12.2%)

Description

Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an authorized attacker to perform spoofing over a network.

FAQ

According to the CVSS metric, user interaction is required (UI:R) and privileges required is Low (PR:L). What does that mean for this vulnerability? An authorized attacker with privileges could send controlled inputs to exploit this vulnerability. What additional customer action is needed to be protected? The customer action needed is to restart Ambari server in both of the head nodes to have this fix updated.

Affected Products (1)

Azure

• Azure HDInsight

Security Updates (2)

• Release Notes
• Release Notes

Acknowledgments

<a href="https://www.linkedin.com/in/tomer-nahum-977a021b5/">Tomer Nahum</a> with <a href="https://www.semperis.com/">Semperis</a>

Revision History

• 2026-02-10: Information published.