CVE-2026-83948

Microsoft Azure CLI Remote Code Execution Vulnerability

Published Sep 8, 2026 CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Description

Improper neutralization of special elements used in a command ('command injection') in Microsoft Azure CLI allows an authorized attacker to execute code over a network.

Analysis

Technical impact

Microsoft Azure CLI contains an improper neutralization of special elements used in a command, allowing a command injection vulnerability. An attacker who has authorized access can supply crafted input that will be executed on the host where the CLI runs, potentially compromising confidentiality, integrity, and availability of that system. The weakness is a classic command injection flaw (CWE-77).

Affected Systems

The vulnerability affects Microsoft Azure CLI. Specific version details are not disclosed in the official advisory, so all versions of Azure CLI may be vulnerable until a patch is applied.

Risk and Exploitability

The CVSS score of 8.0 indicates a high severity. No EPSS score is available, and the issue is not currently listed in CISA KEV, but the lack of a public exploit does not diminish the risk to an authorized attacker who can send crafted requests over the network. The likely attack vector is through network interfaces or scripts that invoke Azure CLI with unsanitized user input.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Microsoft

Microsoft Azure CLI

affected

Version	Status	Constraints
`1.0.0`	affected	< 2.2.1

Configuration 1 [-]

cpe:2.3:a:microsoft:vm_repair:*:*:*:*:*:azure_cli:*:*

No data.

Vendor Product Versions

Microsoft

Azure Cli

Version	Status	Scheme	Platform
`[1.0.0,2.2.1)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Microsoft Azure CLI to the latest released version that contains the vendor’s fix.
Restrict network access to Azure CLI operations to trusted hosts and IP ranges, reducing the reach of an attacker who might have compromised credentials.
Apply input validation or sandboxing to any custom scripts that invoke Azure CLI, ensuring arguments are properly escaped or filtered before execution.

Generated by OpenCVE AI on September 9, 2026 at 03:19 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.594% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83948

History

Sep 17, 2026 2:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 14, 2026 1:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Microsoft vm Repair
CPEs		cpe:2.3:a:microsoft:vm_repair::::::azure_cli::*
Vendors & Products		Microsoft vm Repair

Sep 8, 2026 5:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Improper neutralization of special elements used in a command ('command injection') in Microsoft Azure CLI allows an authorized attacker to execute code over a network.
Title		Microsoft Azure CLI Remote Code Execution Vulnerability
First Time appeared		Microsoft Microsoft azure Cli
Weaknesses		CWE-77
CPEs		cpe:2.3:a:microsoft:azure_cli::::::::
Vendors & Products		Microsoft Microsoft azure Cli
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83948
Metrics		cvssV3_1 `{'score': 8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C'}`