What is the CVSS score of CVE-2026-65806?

CVE-2026-65806 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Is there a patch available for CVE-2026-65806?

Yes, a patch is available for CVE-2026-65806. Update the affected software to the latest version immediately.

Azure CycleCloud CVE-2026-65806

EUVD-2026-56592 MEDIUM

Missing Authorization (CWE-862)

2026-08-11 secure@microsoft.com

GHSA-wf3j-79gj-v8gq

Authentication Bypass Microsoft Azure Cyclecloud

6.5

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-reachable by any authenticated low-privileged user with no interaction; confidentiality-only impact consistent with information disclosure; no integrity or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 22:15 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:19 nvd

MEDIUM 6.5

DescriptionCVE.org

Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network.

AnalysisAI

Information disclosure in Azure CycleCloud allows an authenticated network attacker to bypass authorization checks and read sensitive data. Rooted in CWE-862 (Missing Authorization), the flaw affects versions up to 8.9.2 and is exploitable by any authorized user who can reach the service over a network without elevated privileges. No public exploit or CISA KEV listing has been identified at time of analysis, and Microsoft has released a patch.

Technical ContextAI

Azure CycleCloud is Microsoft's HPC cluster orchestration platform, typically deployed in enterprise Azure environments to manage large-scale compute workloads. The vulnerability is classified under CWE-862 (Missing Authorization), indicating that one or more server-side operations fail to enforce access control checks before returning sensitive data. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the flaw is reachable over a network by any low-privileged authenticated user with no special conditions or user interaction required. Affected CPE data from EUVD identifies the vulnerable release as Azure CycleCloud 8.9.2.

RemediationAI

Apply the vendor-released patch per the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65806. The EUVD data references version 8.9.2 as the boundary; consult the MSRC advisory directly to confirm the first fully patched release, as the version string is ambiguous. If immediate patching is not possible, restrict CycleCloud portal and API access to the minimum required set of authenticated users via network-level controls (e.g., Azure Network Security Groups or private endpoint configuration), and audit current user roles to ensure least-privilege access is enforced. Reducing the pool of authenticated users who can reach the service limits the exploitable surface until a patch can be applied. Note that network restriction does not fix the underlying authorization flaw and is a temporary control only.