ZDI-26-226 CRITICAL 9.8 Published Mar 24, 2026

Microsoft Azure MCP AzureCliService Command Injection Remote Code Execution Vulnerability

Microsoft

A critical remote code execution vulnerability (CVSS 9.8) has been discovered in Microsoft Azure that requires no authentication to exploit, allowing attackers to execute arbitrary code on affected systems. This represents a severe risk as any unauthenticated attacker on the internet can potentially compromise Azure installations. Security teams should immediately apply patches from Microsoft and review their Azure deployments for signs of exploitation, treating this as a high-priority incident response priority.

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy