CVE-2026-100207

HighCVSS 7.3/10Last modified Oct 16, 2026

Description

Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 16, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-1002088.1Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1002098.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-100218.8Insufficient validation of untrusted input in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary coCVE-2026-1002108.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1002118.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1002128.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.CVE-2026-1002148.8Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network.CVE-2026-1002157.8Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.CVE-2026-1002167.0Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.CVE-2026-1002177.8Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.CVE-2026-1002188.1Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.CVE-2026-1002199.8Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
CVE-2026-100207: High severity, CVSS 7.3 | Vulnix