CVE-2026-65806

mediumpriority · track · 0OT risk · elevatedEPSS 0.008 · 58 %ileDEEUNLUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.84% (58th) EPSS

CVSS 6.5 · medium

Is it mine?

35 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cert_bund · msrc_csaf

EPSS · scored 2026-10-27

Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedAzure CycleCloud 8.9.2msrc_csaf
8.9.2:Security Update:https://learn.microsoft.com/en-us/azure/cyclecloud/release-notes/8-9-2?view=cyclecloud-8
https://learn.microsoft.com/en-us/azure/cyclecloud/release-notes/8-9-2?view=cyclecloud-8

cvss

Technical severity, 0–10. One row per scoring source.

6.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:Csecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · secure@microsoft.com USexploitability 2.8 · impact 3.6

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:Csecondary · NCSC-NL NL

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:Csecondary · Microsoft Security Response Center US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-862USCWE-862USCWE-862US

affected products (35)

Products and version ranges known to be affected.

Microsoft Azure Active Directoryall versionscert_bundDEcpe:/a:microsoft:azure:active_directory
Microsoft Azure Confidential Ledgerall versionscert_bundDEcpe:/a:microsoft:azure:confidential_ledger
Microsoft Azure CycleCloud 8.9.1all versionscert_bundDEcpe:/a:microsoft:azure:cyclecloud_8.9.1
Microsoft Azure CycleCloud 8.9.2all versionscert_bundDEcpe:/a:microsoft:azure:cyclecloud_8.9.2
Microsoft Azure Kubernetes Serviceall versionscert_bundDEcpe:/a:microsoft:azure:kubernetes_service
Microsoft Azure Logic Appsall versionscert_bundDEcpe:/a:microsoft:azure:logic_apps
Microsoft Azure Monitor Agent Linux Extensionall versionscert_bundDEcpe:/a:microsoft:azure:monitor_agent_linux_extension
Microsoft Azure SQL Databaseall versionscert_bundDEcpe:/a:microsoft:azure:sql_database
Microsoft Azure SRE Agentall versionscert_bundDEcpe:/a:microsoft:azure:sre_agent
Microsoft Entra Connectall versionscert_bundDEcpe:/a:microsoft:entra:connect
Microsoft Entra IDall versionscert_bundDEcpe:/a:microsoft:entra:id
Microsoft Entra Provisioning Serviceall versionscert_bundDEcpe:/a:microsoft:entra:provisioning_service
Microsoft Azure CycleCloud 8.9.28.9.2 → 8.9.2enisa_euvdEU
Microsoft Azure CycleCloud 8.9.2all versionsfixedmsrc_csafUS
Microsoft Azure CycleCloud 8.9.2< 8.9.2msrc_csafUS
Microsoft Application Insights Profiler≤ vers:unknown/*ncsc_nlNL
Microsoft Azure≤ vers:unknown/*ncsc_nlNL
Microsoft Azure Active Directory≤ vers:unknown/*ncsc_nlNL
Microsoft Azure Confidential Ledger≤ vers:unknown/*ncsc_nlNL
Microsoft Azure CycleCloud 8.9.1≤ vers:unknown/*ncsc_nlNL

showing 20 of 35

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2026-0287Kwetsbaarheden verholpen in Microsoft AzureNL2026-08-12csaf · ncsc_nlNL
Microsoft heeft kwetsbaarheden verholpen in diverse Azure componenten.
WID-SEC-W-2026-2779Microsoft Azure und Entra ID: Mehrere SchwachstellenDeutsch2026-08-11csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Microsoft Azure und Microsoft Entra ausnutzen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, um falsche Informationen darzustellen, und um beliebigen Programmcode auszuführen.
msrc_CVE-2026-65806Azure CycleCloud Information Disclosure Vulnerability2026-08-11csaf · msrc_csafUS
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cert_bund msrc_csaf ncsc_nl NVD CVE.org MITRE

published 2026-08-11modified 2026-10-24

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan