CVE-2026-65770: CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') in Microsoft Azure Managed Instance for Apache Cassandra

This vulnerability (CVE-2026-65770) in Azure Managed Instance for Apache Cassandra is due to improper neutralization of argument delimiters in commands, classified under CWE-88 (Argument Injection). It enables an attacker without privileges to execute arbitrary code remotely over the network. The CVSS 3.1 base score is 10.0, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. Microsoft manages remediation for this cloud-hosted service and has released an official fix.

An unauthorized attacker can remotely execute arbitrary code on the Azure Managed Instance for Apache Cassandra service, potentially leading to full compromise of the affected instance. The vulnerability impacts confidentiality, integrity, and availability at the highest level.

Microsoft has released an official fix for this vulnerability. As this is a cloud service, Microsoft manages the remediation server-side. Users should consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65770 for confirmation and ensure their Azure Managed Instance for Apache Cassandra is updated accordingly.