EUVD-2026-63619
GHSA-47hp-vwhc-cpvh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Description states unauthorized attacker executes code over a network with no interaction (AV:N/AC:L/PR:N/UI:N); argument injection yielding RCE across a service boundary justifies S:C and C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network.
Articles & Coverage 1
AnalysisAI
Remote code execution in Microsoft's Azure Managed Instance for Apache Cassandra allows an unauthenticated network attacker to inject additional command-line arguments (CWE-88) into a backend process and execute arbitrary code, per the CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) that indicates no authentication or user interaction and a scope change beyond the vulnerable component. Microsoft reported the issue and has released a fix through MSRC. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication or user interaction is required, so exploitation is remote and unauthenticated against the service. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue on paper: the CVSS 3.1 base score is 10.0 with a fully remote, low-complexity, unauthenticated, no-interaction vector and scope change, meaning a successful attack breaches the trust boundary of the managed service. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: Microsoft has released a fix, and for a managed cloud service the remediation is primarily applied by Microsoft on the service side, so customers should confirm via the MSRC advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65770) that the update has reached their subscription and regions and review any customer-side action items Microsoft specifies there. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and document all Azure Managed Instance for Apache Cassandra deployments in your environment and assess which are production-critical. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today