CVE-2026-77909

MediumCVSS 6.5/10Last modified Sep 29, 2026

Description

Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

VendorProductVersions
MicrosoftAzure CycleCloud 8.9.2>= 8.9.2, < 8.9.2

References

Timeline

Published
Sep 8, 2026
Last modified
Sep 29, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-77917.8Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows beforeCVE-2026-779108.8Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-779116.5Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.CVE-2026-779125.4A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to injecCVE-2026-779159.8rConfig Core 8.0.0 before 8.2.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register accoCVE-2026-77925.3The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to InsufficCVE-2026-779234.3Dolibarr 21.0.0 before 24.0.0 contains an authorization bypass vulnerability caused by an inverted boolean condition in the private-project CVE-2026-779268.8Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands throuCVE-2026-779276.5ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from CVE-2026-779286.5ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database cCVE-2026-779298.8ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uplCVE-2026-779309.8EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating the
CVE-2026-77909: Medium severity, CVSS 6.5 | Vulnix