The vulnerability is an OS command injection flaw (CWE-78) caused by improper neutralization of special elements used in an system command. An attacker with authorized access can execute arbitrary commands locally on an Azure CycleCloud installation, allowing compromise of system confidentiality, integrity, and availability.

Microsoft Azure CycleCloud 8.9.1 and 8.9.2 are affected. No other versions have been identified as vulnerable in the available data.

The CVSS score of 7.3 indicates a high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that a widespread public exploit has not yet been observed. The likely attack vector requires the attacker to have legitimate credentials or authorized access to the CycleCloud environment; once authorized, the attacker can run arbitrary code locally.