What is the CVSS score of CVE-2026-57969?

CVE-2026-57969 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Azure CycleCloud are affected by CVE-2026-57969?

Microsoft Azure CycleCloud 8.9.1 contains a privilege escalation vulnerability (CVE-2026-57969) that allows authenticated users with low privileges to gain complete system control, directly…. A patch is available.

How to fix or mitigate CVE-2026-57969?

Within 24 hours, inventory all Azure CycleCloud deployments and identify instances running version 8.9.1, categorizing by operational criticality. Within 7 days, deploy the vendor-released patch to all affected instances starting with production HPC clusters, then staging and development environments. Complete post-patch validation within 30 days to confirm cluster scheduling, workload orchestration, and user access remain operational, then document all patched systems and their patch dates in your asset register.

Azure CycleCloud CVE-2026-57969

EUVD-2026-43760 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-14 microsoft

GHSA-5hx7-jrq3-6879

Authentication Bypass Microsoft Azure Cyclecloud 8 9 1

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.8 HIGH

Network-reachable management function with low complexity and no UI; PR:L because an existing low-privilege authenticated foothold is required, and the missing auth check yields full C/I/A compromise.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 17:52 vuln.today

CVE Published

Jul 14, 2026 - 17:05 nvd

HIGH 8.8

DescriptionCVE.org

Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Azure CycleCloud 8.9.1 allows an authorized (low-privileged) attacker to gain elevated privileges over the network by reaching a critical function that lacks an authentication check (CWE-306). Reported by Microsoft with a patch available and rated CVSS 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The flaw enables full compromise of the CycleCloud instance's confidentiality, integrity, and availability, making it a high-priority patch for HPC-orchestration environments.

Technical ContextAI

Azure CycleCloud is Microsoft's orchestration platform for creating, managing, and scaling High-Performance Computing (HPC) clusters on Azure. The root cause is classed as CWE-306 (Missing Authentication for Critical Function): a sensitive, privileged operation exposed by the CycleCloud management service does not verify the caller's authorization before executing, so a user who already holds some low level of access can invoke functionality reserved for higher-privileged roles. The affected build per the CPE data is cpe:2.3:a:microsoft:azure_cyclecloud_8.9.1, indicating the 8.9.1 release line of the product is in scope.

RemediationAI

Apply the vendor patch - Patch available per vendor advisory (Microsoft MSRC): review and follow the update guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57969 to move Azure CycleCloud off the vulnerable 8.9.1 line to the fixed release; the exact patched version number is not stated in the provided data, so obtain it directly from the MSRC update guide. Until patching is complete, reduce exposure of the CycleCloud management interface by restricting network access to the CycleCloud server so it is reachable only from trusted administrative networks or via VPN/bastion (trade-off: may disrupt legitimate remote operators and automation), and tighten and audit the accounts that hold any low-privilege access to CycleCloud since PR:L exploitation depends on an existing authenticated foothold (trade-off: credential review and least-privilege enforcement add operational overhead). Monitor CycleCloud logs for unexpected privileged operations invoked by low-privilege users as a detective control.