What is the CVSS score of CVE-2026-70340?

CVE-2026-70340 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Azure CycleCloud are affected by CVE-2026-70340?

Microsoft Azure CycleCloud contains a privilege escalation vulnerability (CVE-2026-70340) affecting computational cluster management infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-70340?

Within 24 hours, inventory all Microsoft Azure CycleCloud deployments and document current versions. Within 7 days, upgrade all affected instances to version 8.9.1 or later, prioritizing production environments; coordinate carefully with research and AI teams as upgrades may require cluster downtime. Within 30 days, review and audit access logs from prior versions for unauthorized privilege escalation attempts, and validate that post-upgrade authorization controls are functioning as expected.

Azure CycleCloud CVE-2026-70340

EUVD-2026-56591 HIGH

Missing Authorization (CWE-862)

2026-08-11 secure@microsoft.com

GHSA-mjq4-9r9p-4wxh

Authentication Bypass Microsoft Azure Cyclecloud

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable authorization bypass requires only a valid low-privilege account (PR:L); full C/I/A reflects administrative privilege acquisition within the application boundary.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 17, 2026 - 19:58 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 17, 2026 - 19:52 vuln.today

cvss_changed

CVSS changed

Aug 17, 2026 - 19:52 NVD

8.1 (HIGH) 8.8 (HIGH)

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 17:49 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 8.1

DescriptionNVD

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Azure CycleCloud (versions prior to 8.9.1) allows an authenticated low-privilege network attacker to elevate to higher privilege levels due to missing authorization checks (CWE-862). The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability with no user interaction required, though exploitation demands valid credentials. No public exploit has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog, though SSVC rates the technical impact as total.

Technical ContextAI

Azure CycleCloud is Microsoft's HPC (High-Performance Computing) cluster orchestration and management platform, enabling enterprises to create, manage, and autoscale compute clusters on Azure for batch and parallel workloads. The root cause is CWE-862 (Missing Authorization), a weakness where the application executes a privileged operation without verifying that the requesting principal holds sufficient permission - distinct from authentication failures (CWE-287) in that the user is legitimately identified but authorization gates are absent or bypassed. The CPE string cpe:2.3:a:microsoft:azure_cyclecloud:*:*:*:*:*:*:*:* covers all platform and OS combinations, and EUVD-2026-56591 narrows the vulnerable range to versions 1.0.0 through below 8.9.1. The network attack vector (AV:N) indicates the deficient authorization check is reachable via the CycleCloud API or web management surface without requiring local system access.

RemediationAI

The primary remediation is upgrading Azure CycleCloud to version 8.9.1 or later, which resolves the missing authorization flaw per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70340. As compensating controls prior to patching, administrators should restrict network access to the CycleCloud management interface using Azure Network Security Groups or firewall rules, limiting reachability to known-trusted IP ranges only - this raises the effective attack complexity without eliminating the underlying flaw. Enforcing Azure Active Directory Conditional Access policies requiring MFA for all CycleCloud-authenticated sessions reduces the risk of credential-based exploitation; note this introduces additional login friction for legitimate HPC users. A privilege audit of existing CycleCloud accounts to enforce least-privilege role assignments is also advisable, as the vulnerability requires an existing low-privilege account as a prerequisite. Patch deployment is the only confirmed resolution.