This vulnerability (CVE-2026-35428) involves improper neutralization of special elements in commands within Microsoft Azure Cloud Shell, classified as CWE-77 (Command Injection). It enables an unauthorized attacker to conduct spoofing attacks over a network, potentially compromising confidentiality, integrity, and availability of the service. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability. Microsoft has released an official fix and manages remediation for this cloud service. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35428.

Successful exploitation could allow an attacker to perform network-based spoofing attacks, leading to full compromise of confidentiality, integrity, and availability of the Azure Cloud Shell environment. This could result in unauthorized command execution and control over the affected service.

Microsoft has released an official fix for this vulnerability and manages remediation for Azure Cloud Shell as a cloud-hosted service. Users should ensure their Azure Cloud Shell environments are updated and monitor the Microsoft Security Response Center advisory for confirmation of applied fixes. No additional user action is required beyond applying updates or relying on the vendor's managed remediation.