CVE-2026-35428 is a command injection vulnerability (CWE-77) in Microsoft Azure Cloud Shell. It arises from improper neutralization of special elements used in commands, enabling unauthorized attackers to conduct spoofing over a network. The vulnerability affects the cloud-hosted Azure Cloud Shell service and has a CVSS 3.1 base score of 9.6, reflecting critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, and complete impact on confidentiality, integrity, and availability. Microsoft has released an official fix and manages remediation for this cloud service. The vendor advisory is available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35428.

Successful exploitation of this vulnerability can lead to network spoofing attacks by unauthorized actors, potentially compromising confidentiality, integrity, and availability of the Azure Cloud Shell environment. Given the critical CVSS score of 9.6, the impact is severe. However, no known exploits have been reported in the wild so far.

Microsoft has provided an official fix for this vulnerability and manages remediation for the Azure Cloud Shell cloud service. Users should ensure their Azure Cloud Shell environments are updated according to Microsoft's guidance in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35428. No additional mitigation actions are required beyond applying the official fix.