This vulnerability (CWE-77) in Azure Cloud Shell arises from improper neutralization of special elements used in commands, enabling command injection attacks. Exploitation can lead to spoofing over a network with high impact on confidentiality, integrity, and availability. The vulnerability is rated critical with a CVSS 3.1 score of 9.6, indicating network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed. Microsoft has issued an official fix and manages remediation for this cloud-hosted service.

Successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the Azure Cloud Shell environment, allowing attackers to perform network spoofing and potentially execute arbitrary commands. This poses a critical risk to users relying on Azure Cloud Shell for secure command execution.

Microsoft has released an official fix for this vulnerability and manages remediation for the Azure Cloud Shell cloud service. Users should ensure their Azure Cloud Shell environment is updated according to Microsoft's guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35428. No additional user action is required beyond applying the official fix.