ZDI-26-226
CRITICAL 9.8
Published
Mar 24, 2026
Microsoft Azure MCP AzureCliService Command Injection Remote Code Execution Vulnerability
Microsoft
A critical remote code execution vulnerability (CVSS 9.8) has been discovered in Microsoft Azure that requires no authentication to exploit, allowing attackers to execute arbitrary code on affected systems. This represents a severe risk as any unauthenticated attacker on the internet can potentially compromise Azure installations. Security teams should immediately apply patches from Microsoft and review their Azure deployments for signs of exploitation, treating this as a high-priority incident response priority.