EUVD-2026-73888
GHSA-x7qc-r3g7-w72r
Severity by source
AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Network-accessible injection requiring low-privilege auth and user interaction; scope change justified as injected commands can affect Azure resource plane beyond CLI process.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Improper neutralization of special elements used in a command ('command injection') in Microsoft Azure CLI allows an authorized attacker to execute code over a network.
AnalysisAI
Command injection (CWE-77) in Microsoft Azure CLI versions 1.0.0 through 2.2.0 allows a low-privilege authenticated attacker to execute arbitrary commands over a network when user interaction is obtained. The Scope Changed attribute in the CVSS vector indicates injected commands can break out of the CLI security context and affect resources beyond the immediate process - likely Azure resource management operations or the underlying host OS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the attacker holds at minimum a low-privilege Azure account (PR:L - anonymous/unauthenticated exploitation is not possible); (2) the target user must actively execute a CLI command or interact in a manner that processes the attacker-controlled input (UI:R - no passive or drive-by exploitation path); (3) high attack complexity (AC:H) implies additional conditions must align, such as a specific CLI invocation context, a command parameter that is vulnerable to injection, or an attacker-controlled value reaching the unsafe command construction path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.0 score is meaningful but the vector tells a more nuanced story. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Microsoft Azure CLI to version 2.2.1 or later, which contains the vendor-released patch. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems, CI/CD pipelines, and container images running Azure CLI versions 1.0.0 through 2.2.0, and document affected deployment locations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today