Dashboard / CVE-2026-100207

CVE-2026-100207

HIGH
MEDIUM Priority: 0.03 BB Relevance: 30/100
Published: 2026-10-13 Modified: 2026-10-29 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: Required
S: Unchanged
C: High
I: High
A: High

Description

Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.

Weakness Classification (1)

Affected Software (3)

VendorProductVersion
Microsoft Azure CycleCloud 8.9.1 1.0.0 < 8.9.2
Microsoft Azure CycleCloud 8.9.1 1.0.0 < 8.9.2
Microsoft Azure CycleCloud 8.9.1 1.0.0 < 8.9.2

References & Advisories (1)

Bug Bounty Relevance

30 / 100
✓ Low complexity

CVSS Score

7.3 / 10.0 v3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

EPSS — Exploitation Probability

0.44%
Raw Score 0.004420
Percentile 38.3%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00442
2026-10-28
0.00442

Intelligence Sources

mitre ref →

External Links