SB20261110349 - OS Command Injection in Azure CycleCloud

Description

This security bulletin contains information about 1 vulnerability.

1) OS Command Injection (CVE-ID: CVE-2026-102224)

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSSv4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote privileged user to escalate privileges and execute commands as root on the cluster controller.

The vulnerability exists due to improper neutralization of special elements used in an OS command in the Azure CycleCloud topology operation when processing a specially crafted node name. A remote privileged user can register a specially crafted node name for a compute node they control to execute commands as root on the cluster controller if an administrator later runs the affected topology operation.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-102224
• https://learn.microsoft.com/en-us/azure/cyclecloud/release-notes/8-10-1?view=cyclecloud-8