EUVD-2026-43764
GHSA-4wr5-3qvr-f367
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-reachable management API requires authenticated low-privilege account; missing authorization yields high integrity impact with no confidentiality or availability effect.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft Azure CycleCloud allows a network-authenticated low-privileged attacker to elevate their access level by exploiting a missing authorization check (CWE-862). All Azure CycleCloud versions from 1.0.0 up to 8.9.1 are affected, with version 8.9.1 serving as the patched release. Publicly available exploit code exists per SSVC assessment, though EPSS probability remains low at 0.37% (29th percentile), suggesting limited but non-zero exploitation interest.
Technical ContextAI
Azure CycleCloud is Microsoft's cloud HPC (high-performance computing) cluster management platform, enabling orchestration of large-scale compute clusters on Azure. The root cause is CWE-862 (Missing Authorization), meaning the application performs an action on behalf of an authenticated user without first verifying that the user holds the necessary permission for that action. This is structurally distinct from authentication bypass - the attacker is legitimately authenticated but the authorization layer fails to enforce role boundaries, allowing a low-privileged principal to invoke privileged operations. The CPE string cpe:2.3:a:microsoft:azure_cyclecloud_8.9.1 identifies version 8.9.1 as the boundary, and EUVD data confirms versions 1.0.0 through below 8.9.1 carry this flaw. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) confirms network-accessible exploitation with no integrity protections but no confidentiality or availability impact.
RemediationAI
Upgrade Azure CycleCloud to version 8.9.1 or later, which resolves the missing authorization flaw. The patch is available through the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58279. If immediate upgrade is not feasible, restrict CycleCloud API and management interface access to known, trusted, least-privilege service accounts only - reducing the pool of principals who could abuse the authorization gap. Additionally, audit existing CycleCloud role assignments to identify any accounts with unexpectedly elevated effective permissions, as the vulnerability may have already been leveraged if proof-of-concept code has been tested in the environment. Note that access restrictions are compensating controls only and do not eliminate the underlying flaw.
More in Azure Cyclecloud 8 9 1
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today