CVE-2026-83948

CVE-2026-83948 is a command injection flaw (CWE-77) in Microsoft Azure CLI in which special shell elements are not properly neutralized before the CLI executes commands. To trigger it, an attacker who already holds some authorized (low-privilege) access must get crafted input with special characters processed by Azure CLI in a user's session, over the network, with user interaction required and high attack complexity, per the CVSS vector. A successful attack yields remote code execution in the context of the user running the CLI, and because the CVSS scope is 'changed', code may execute beyond the vulnerable component, with high impact to confidentiality, integrity and availability. Any organization running Azure CLI on admin workstations, servers, or CI/CD pipelines is potentially affected, though specific affected and fixed versions are not stated in the available data; Microsoft shipped the fix in its September 2026 Patch Tuesday release. There is no evidence of exploitation so far: the flaw is not in CISA KEV, no public proof-of-concept is known, and EPSS assigns only a 0.4% probability of exploitation in the next 30 days.

What to do: Update Azure CLI to the patched version delivered in Microsoft's September 2026 security updates (check Microsoft's advisory for the exact fixed version number). Until patched, limit Azure CLI use to trusted sessions and avoid running it with crafted or untrusted input in interactive sessions, and inventory admin workstations, jump hosts, and CI/CD runners where the tool is installed. Because exploitation requires existing authorized access, prioritize remediation on environments where lower-privileged Azure identities or external users can reach CLI sessions.