{"id":"CVE-2026-113822","kind":"vulnerability","aliases":["CVE-2026-113822"],"related":[],"title":"Azure CycleCloud: missing authorization lets a signed-in user gain higher privileges","description":"Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.","summary":"Azure CycleCloud lacks an authorization check, so an attacker who already has an account can raise their privileges over the network. The sources give no further detail on which action is affected.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["azure","azure-cyclecloud","hpc","vendor"],"not_affected_if":["no-authenticated-users"],"how_to_check":"- Confirm whether your team runs Azure CycleCloud and which version is deployed in the Azure portal or on the CycleCloud server.\n- Check the affected version range in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-113822: unknown from the sources given.","fix":null,"status":"open","published_at":"2026-11-10T19:19:02+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","triaged_at":"2026-11-10T19:57:54+00:00","updated_at":"2026-11-10T19:57:54+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T19:57:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Azure CycleCloud: missing authorization lets a signed-in user gain higher privileges","impact":"medium","summary":"Azure CycleCloud lacks an authorization check, so an attacker who already has an account can raise their privileges over the network. The sources give no further detail on which action is affected.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["azure","azure-cyclecloud","hpc"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authorized user gains elevated privileges over the network","analyst_note":"Find the Microsoft advisory for CVE-2026-113822 to confirm affected versions, the fixed release, and the specific vulnerable function.","how_to_check":"- Confirm whether your team runs Azure CycleCloud and which version is deployed in the Azure portal or on the CycleCloud server.\n- Check the affected version range in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-113822: unknown from the sources given.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-authenticated-users"],"who_is_affected":"Teams running Azure CycleCloud, the HPC and cluster management service, where users have authenticated accounts. The sources do not name the affected versions or the specific function, so exposure can only be confirmed against the vendor's advisory. Deployments where only administrators have accounts are likely lower risk, but the sources do not say so.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4487,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113822':16A,19A '-2026':15A,18A 'account':39B 'action':55B 'affect':57B 'allow':63C 'alreadi':36B 'attack':34B,66C 'author':4A,30B,59C,65C 'azur':1A,20B,22B,26B,61C 'azure-cyclecloud':21B 'check':31B 'cve':14A,17A 'cyclecloud':2A,23B,27B,62C 'detail':52B 'elev':68C 'gain':11A 'give':49B 'higher':12A 'hpc':24B 'lack':28B 'let':5A 'miss':3A,58C 'network':46B,72C 'privileg':13A,43B,69C 'rais':41B 'sign':8A 'signed-in':7A 'sourc':48B 'user':10A 'vendor':25B","nicknames":[],"mitigations":[],"who_affected":"Teams running Azure CycleCloud, the HPC and cluster management service, where users have authenticated accounts. The sources do not name the affected versions or the specific function, so exposure can only be confirmed against the vendor's advisory. Deployments where only administrators have accounts are likely lower risk, but the sources do not say so.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["azure","azurecyclecloud","hpc","medium","vendor"],"campaign_type":null,"search_a":"'-113822':16A,19A '-2026':15A,18A 'author':4A 'azur':1A 'cve':14A,17A 'cyclecloud':2A 'gain':11A 'higher':12A 'let':5A 'miss':3A 'privileg':13A 'sign':8A 'signed-in':7A 'user':10A","search_b":"'account':39B 'action':55B 'affect':57B 'alreadi':36B 'attack':34B 'author':30B 'azur':20B,22B,26B 'azure-cyclecloud':21B 'check':31B 'cyclecloud':23B,27B 'detail':52B 'give':49B 'hpc':24B 'lack':28B 'network':46B 'privileg':43B 'rais':41B 'sourc':48B 'vendor':25B","search_c":"'allow':63C 'attack':66C 'author':59C,65C 'azur':61C 'cyclecloud':62C 'elev':68C 'miss':58C 'network':72C 'privileg':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113822","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113822","severity":null,"published_at":"2026-11-10T19:19:02+00:00","modified_at":"2026-11-10T19:19:04+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","fetched_at":"2026-11-10T19:24:42+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}