CVE-2026-114161

HighCVSS 7.8/10Last modified Nov 10, 2026

Description

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Microsoft	Azure CycleCloud 8.9.2	>= 8.9.2, < 8.10.1

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-114161

Timeline

Published: Nov 10, 2026
Last modified: Nov 10, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1141629.1Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over a network.CVE-2026-1141648.8Integer underflow (wrap or wraparound) in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.CVE-2026-1141657.8Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.CVE-2026-1141665.5Buffer over-read in Windows Raw Image Extension allows an unauthorized attacker to disclose information locally.CVE-2026-1141677.8Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.CVE-2026-1141698.8Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.CVE-2026-114177.3OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 (2.246.0 on Windows) might allow an actor w CVE-2026-1141707.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-1141718.8User interface (ui) misrepresentation of critical information in Visual Studio Code allows an unauthorized attacker to bypass a security fea CVE-2026-1141735.3The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthen CVE-2026-1141755.4Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control S CVE-2026-1141764.3Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control S