CVE-2026-21522

CVSS 3.1: 6.7 medium
EPSS: <1%p36
Published: Feb 10, 2026 · Feb 10, 2026
Modified: Jun 17, 2026

Analyze CVE-2026-21522 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.

Vendors: microsoft

Products: confcom

Weakness: CWE-77

Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news

1 story

Microsoft Patch Tuesday for February 2026 — Snort rules and prominent vulnerabilities

Cisco TalosFeb 10, 23:54 UTC · Feb 10, 2026VulnerabilityExploitedCVE-2026-21522 CVE-2026-23655 CVE-2026-21525+124 · 1 read