VulnerabilityPublished
ZDI-26-226: (0Day) Microsoft Azure MCP AzureCliService Command Injection Remote Code Execution Vulnerability
Source Zero Day Initiative
0
Severity
CriticalRated Critical by Zero Day Initiative
Data as of 26 May 2026, 20:33 UTC
What to do
AI-suggested
The vendor rated the severity as Moderate but has not provided remediation guidance. The advisory recommends restricting interaction with the affected azure-cli-mcp component to mitigate risk.
Description
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Azure. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8.
References
Community reviews
Loading reviews…