What is the CVSS score of CVE-2026-35428?

CVE-2026-35428 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Azure Cloud Shell are affected by CVE-2026-35428?

CVE-2026-35428 is a critical command injection vulnerability in Azure Cloud Shell that permits unauthenticated remote attackers to execute arbitrary commands and hijack user sessions through…. A patch is available.

How to fix or mitigate CVE-2026-35428?

24 hours: Identify all Azure Cloud Shell deployments and users; communicate patch urgency to Azure infrastructure teams and begin testing Microsoft's MSRC-released patch in non-production environments. 7 days: Deploy the vendor-released patch to all production Azure Cloud Shell instances and verify successful application via audit logs; issue security advisory to end-users warning against opening suspicious links within Cloud Shell sessions. 30 days: Conduct post-patch validation testing; review Cloud Shell command execution logs for indicators of compromise; implement conditional access policies restricting Cloud Shell access to trusted networks where feasible.

Azure Cloud Shell CVE-2026-35428

EUVD-2026-28453 CRITICAL

Command Injection (CWE-77)

2026-05-07 microsoft

GHSA-mgh8-qx2p-mmfj

Microsoft Command Injection

9.6

CVSS 3.1 · NVD

Temporal: 8.3

Severity by source

NVD PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

8.3 HIGH

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 07, 2026 - 22:03 vuln.today

CVE Published

May 07, 2026 - 20:58 nvd

CRITICAL 9.6

DescriptionCVE.org

Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing over a network.

AnalysisAI

Command injection in Azure Cloud Shell enables remote attackers to execute arbitrary commands and spoof user sessions when victims interact with malicious content. The vulnerability requires user interaction (UI:R) but no authentication (PR:N), allowing network-based attackers to achieve high impact across confidentiality, integrity, and availability with scope change (S:C), indicating potential container escape or cross-tenant impact. Microsoft has released a patch per MSRC advisory. EPSS data not available, no CISA KEV listing identified, suggesting targeted rather than widespread exploitation at time of analysis.

Technical ContextAI

Azure Cloud Shell is Microsoft's browser-based command-line environment providing authenticated access to Azure resources via Bash or PowerShell, running in isolated Linux containers. This command injection vulnerability (CWE-77) occurs when the service fails to properly sanitize user-supplied input before passing it to system command execution functions. The CVSS scope change metric (S:C) indicates the vulnerability may allow escape from the Cloud Shell container's security boundary, potentially affecting resources beyond the vulnerable component itself. Command injection flaws typically arise from unsafe concatenation of user input with shell commands, use of dangerous functions like eval() or exec(), or insufficient input validation in web-based terminal implementations.

RemediationAI

Microsoft has released a patch for Azure Cloud Shell per MSRC advisory CVE-2026-35428 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35428). Since Azure Cloud Shell is a Microsoft-hosted service, users do not need to manually apply updates - Microsoft manages patching on the backend infrastructure. Organizations should verify patch deployment by consulting the MSRC advisory for confirmation dates and reviewing Azure Service Health notifications for their tenant. As interim mitigations until patch confirmation: restrict Cloud Shell access using Azure RBAC policies to only trusted administrators who require it (reduces attack surface by limiting potential victims); implement Conditional Access policies requiring compliant devices and trusted locations for Cloud Shell sessions (limits attacker ability to leverage compromised credentials post-exploitation); monitor Azure Activity Logs for unexpected Cloud Shell usage patterns or commands executed from unusual IP addresses/locations; educate administrators not to open untrusted links or paste unknown commands while Cloud Shell sessions are active (reduces user interaction attack vector). Note that completely disabling Cloud Shell eliminates risk but may disrupt legitimate administrative workflows - assess operational impact before implementation. Web content filtering to block known malicious domains can reduce phishing vector effectiveness.