Azure Hdinsight

CVE-2026-81349 Sep 08, 18:20 HIGH PATCH This Week

OS command injection in Azure HDInsight allows a network-accessible, high-privileged attacker to escalate privileges on the underlying cluster infrastructure. The vulnerability (CWE-78) arises from insufficient neutralization of special characters passed to OS-level commands within the HDInsight control plane or management interface, enabling an authorized administrator to break out of their intended permission scope and execute arbitrary OS commands. Reported via Microsoft MSRC (secure@microsoft.com), a vendor patch has been released; no public exploit code or CISA KEV listing is present at time of analysis.

CVE-2026-21529 Feb 10, 18:16 MEDIUM PATCH This Month

Azure HDInsight contains a cross-site scripting (XSS) vulnerability in web page generation that allows authenticated attackers to conduct spoofing attacks over the network. An attacker with valid credentials and user interaction can exploit this weakness to manipulate web content and deceive users. No patch is currently available for this issue.

CVE-2023-36419 Oct 10, 18:15 CRITICAL PATCH Act Now

Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.

CVE-2023-38156 Sep 12, 17:15 HIGH PATCH This Week

Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

CVE-2023-38188 Aug 08, 18:15 MEDIUM PATCH This Month

Azure Apache Hadoop Spoofing Vulnerability. Rated medium severity (CVSS 4.5), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2023-36881 Aug 08, 18:15 MEDIUM PATCH This Month

Azure Apache Ambari Spoofing Vulnerability. Rated medium severity (CVSS 4.5), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2023-36877 Aug 08, 18:15 MEDIUM PATCH This Month

Azure Apache Oozie Spoofing Vulnerability. Rated medium severity (CVSS 4.5), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2023-35394 Aug 08, 18:15 MEDIUM PATCH This Month

Azure HDInsight Jupyter Notebook Spoofing Vulnerability. Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2023-35393 Aug 08, 18:15 MEDIUM PATCH This Month

Azure Apache Hive Spoofing Vulnerability. Rated medium severity (CVSS 4.5), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

CVE-2023-23408 Mar 14, 17:15 MEDIUM POC PATCH This Month

Azure Apache Ambari Spoofing Vulnerability. Rated medium severity (CVSS 4.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.