CVE-2026-83948: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') in Microsoft Microsoft Azure CLI

This vulnerability (CVE-2026-83948) in Microsoft Azure CLI is due to improper neutralization of special elements in commands, classified as CWE-77 (Command Injection). It allows an authorized attacker to execute arbitrary code remotely over a network. The vulnerability affects versions 1.0.0 and all versions from 1.0.0 up to but excluding 2.2.1. The CVSS v3.1 score is 8.0 (High), with attack vector network, attack complexity high, privileges required low, user interaction required, and scope changed. Microsoft has published an official fix for this vulnerability and manages remediation for this cloud-hosted service. No known exploits in the wild have been reported.

Successful exploitation allows an authorized attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected system or service. The impact includes complete confidentiality, integrity, and availability loss as indicated by the CVSS metrics.

An official fix is available from Microsoft. Users and administrators should apply the update to Microsoft Azure CLI to versions 2.2.1 or later. Since this is a cloud-hosted service, Microsoft manages remediation server-side; users should verify their environments are updated according to the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83948.