SB2026071755 - Multiple vulnerabilities in Microsoft Azure CycleCloud

Description

This security bulletin contains information about 2 vulnerabilities.

1) Missing Authentication for Critical Function (CVE-ID: CVE-2026-57969)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to missing authentication for critical function in Azure CycleCloud, which leads to security restrictions bypass and privilege escalation.

2) Missing Authorization (CVE-ID: CVE-2026-58279)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to missing authorization in Azure CycleCloud, which leads to security restrictions bypass and privilege escalation.

Remediation

Install update from vendor's website.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57969
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58279