CVE-2026-33109

—1

CVSS 3.1

9.9 critical

EPSS

<1%p51

Published

May 7, 2026 (May 7, 2026)

Modified

Jun 17, 2026

Description

Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.

Vendors: microsoft
Products: azure managed instance for apache cassandra
Weakness: CWE-284
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news3 stories

Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws

The Hacker NewsMay 15, 00:00 UTC · May 15, 2026Vulnerability in the wildCVE-2025-54518 CVE-2026-41096 CVE-2026-42826+14 CVEs1

60

Microsoft Patch Tuesday for May 2026 — Snort rules and prominent vulnerabilities

Cisco TalosMay 13, 15:34 UTC · May 13, 2026Vulnerability in the wildCVE-2026-32161 CVE-2026-33109 CVE-2026-33844+22 CVEs

60

Microsoft addresses 137 vulnerabilities in May’s Patch Tuesday, including 13 rated critical

CyberScoopMay 12, 21:00 UTC · May 12, 2026Vulnerability in the wildCVE-2026-33109 CVE-2026-42823 CVE-2026-42898+2 CVEs

60