Path traversal in Azure CycleCloud - CVE-2026-114161
Published: November 11, 2026
Vulnerability identifier: #VU164970
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-114161
CWE-ID: CWE-22
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges, perform administrative operations in Azure CycleCloud, and execute code with the privileges of its service account.
The vulnerability exists due to improper limitation of a pathname to a restricted directory in Azure CycleCloud when handling pathnames. A local user can exploit path traversal to access resources outside the intended directory and gain administrative capabilities in Azure CycleCloud, including code execution with its service account privileges.
Affected software
Azure CycleCloud
How to mitigate CVE-2026-114161
Install security update from vendor's website.
Azure CycleCloud - update to 8.10.1