This vulnerability (CVE-2026-21522) involves improper neutralization of special elements used in commands (CWE-77) in Microsoft ACI Confidential Containers, part of Azure Compute Gallery. An authorized attacker with high privileges can exploit this command injection flaw to elevate privileges locally. The vulnerability affects version 1.0.0 of the product. The CVSS 3.1 vector indicates local attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix and manages remediation for this cloud-hosted service.

Successful exploitation allows an authorized attacker with high privileges to elevate their privileges locally within the Microsoft ACI Confidential Containers environment. This can lead to full compromise of confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild currently.

Microsoft has released an official fix for this vulnerability and manages remediation for this cloud-hosted service. Users should verify that their Azure Compute Gallery and Microsoft ACI Confidential Containers environments are updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21522. No additional mitigation actions are required beyond applying the official fix.