EUVD-2026-43760
GHSA-5hx7-jrq3-6879
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable management function with low complexity and no UI; PR:L because an existing low-privilege authenticated foothold is required, and the missing auth check yields full C/I/A compromise.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in Microsoft Azure CycleCloud 8.9.1 allows an authorized (low-privileged) attacker to gain elevated privileges over the network by reaching a critical function that lacks an authentication check (CWE-306). Reported by Microsoft with a patch available and rated CVSS 8.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The flaw enables full compromise of the CycleCloud instance's confidentiality, integrity, and availability, making it a high-priority patch for HPC-orchestration environments.
Technical ContextAI
Azure CycleCloud is Microsoft's orchestration platform for creating, managing, and scaling High-Performance Computing (HPC) clusters on Azure. The root cause is classed as CWE-306 (Missing Authentication for Critical Function): a sensitive, privileged operation exposed by the CycleCloud management service does not verify the caller's authorization before executing, so a user who already holds some low level of access can invoke functionality reserved for higher-privileged roles. The affected build per the CPE data is cpe:2.3:a:microsoft:azure_cyclecloud_8.9.1, indicating the 8.9.1 release line of the product is in scope.
RemediationAI
Apply the vendor patch - Patch available per vendor advisory (Microsoft MSRC): review and follow the update guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57969 to move Azure CycleCloud off the vulnerable 8.9.1 line to the fixed release; the exact patched version number is not stated in the provided data, so obtain it directly from the MSRC update guide. Until patching is complete, reduce exposure of the CycleCloud management interface by restricting network access to the CycleCloud server so it is reachable only from trusted administrative networks or via VPN/bastion (trade-off: may disrupt legitimate remote operators and automation), and tighten and audit the accounts that hold any low-privilege access to CycleCloud since PR:L exploitation depends on an existing authenticated foothold (trade-off: credential review and least-privilege enforcement add operational overhead). Monitor CycleCloud logs for unexpected privileged operations invoked by low-privilege users as a detective control.
More in Azure Cyclecloud 8 9 1
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today