This vulnerability, identified as CWE-88 (Improper Neutralization of Argument Delimiters in a Command), affects Microsoft Azure Managed Instance for Apache Cassandra. It allows an attacker without privileges to inject malicious arguments into commands, potentially leading to remote code execution. The vulnerability is remotely exploitable without user interaction and has a critical CVSS 3.1 score of 10. Microsoft has published an official fix and manages remediation for this cloud-hosted service. The vendor advisory is available at the Microsoft Security Response Center.

Successful exploitation can lead to complete compromise of the affected Azure Managed Instance for Apache Cassandra, including full control over the service, resulting in total loss of confidentiality, integrity, and availability. Because this is a cloud service, the impact extends to any data and operations relying on the affected instance.

Microsoft has released an official fix for this vulnerability and manages remediation for the Azure Managed Instance for Apache Cassandra cloud service. Users should consult the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65770 for detailed guidance. No additional user action is required beyond ensuring the service is updated as per Microsoft's instructions.