CVE-2026-81349: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Microsoft Azure HDInsight

This vulnerability (CVE-2026-81349) involves improper neutralization of special elements in OS commands within Microsoft Azure HDInsight, enabling an authorized attacker to perform OS command injection. This can lead to privilege escalation over a network. The CVSS v3.1 score is 7.2, indicating high severity with network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. The affected product is Azure HDInsight version 1.0. Microsoft has issued an official fix and manages remediation for this cloud service.

An authorized attacker can exploit this vulnerability to execute arbitrary OS commands on the affected Azure HDInsight environment, resulting in elevated privileges. This can compromise confidentiality, integrity, and availability of the system and data processed by the service.

Microsoft has released an official fix for this vulnerability. As Azure HDInsight is a cloud service, Microsoft manages the remediation on the server side. Users should consult the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-81349 for detailed patching and update guidance.