OS Command Injection in Azure CycleCloud - CVE-2026-102224
Published: November 10, 2026
Vulnerability identifier: #VU164612
CSH Severity: Low
CVSS v4: 8.4 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-102224
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to escalate privileges and execute commands as root on the cluster controller.
The vulnerability exists due to improper neutralization of special elements used in an OS command in the Azure CycleCloud topology operation when processing a specially crafted node name. A remote privileged user can register a specially crafted node name for a compute node they control to execute commands as root on the cluster controller if an administrator later runs the affected topology operation.
Affected software
Azure CycleCloud
How to mitigate CVE-2026-102224
Install security update from vendor's website.
Azure CycleCloud - update to 8.10.1