CVE-2026-81349

CVE-2026-81349 is an operating-system command injection flaw (CWE-78) in Microsoft's Azure HDInsights managed big-data service. It is triggered when the service improperly neutralizes special elements passed into an OS command, and per the CVSS vector an attacker must already hold high-level authorized access, exploiting it over the network with no user interaction required. Successful exploitation allows the attacker to elevate privileges, with high impact on the confidentiality, integrity, and availability of the affected HDInsight environment. Only organizations running Azure HDInsight clusters are affected; the flaw was fixed as part of Microsoft's September 2026 Patch Tuesday, which addressed 966 flaws. No public proof-of-concept is known, it is not listed in CISA's KEV catalog, and EPSS estimates roughly a 0.7% chance of exploitation within 30 days.

What to do: Review Microsoft's September 2026 Patch Tuesday advisory for CVE-2026-81349 and apply any required service updates or customer actions to HDInsight clusters as directed. Because exploitation requires an already highly privileged authorized attacker, audit and restrict highly privileged roles, service principals, and identities with access to HDInsight resources. Monitor Azure Service Health and the MSRC advisory page for service-side remediation details.