{"id":"CVE-2026-113823","kind":"vulnerability","aliases":["CVE-2026-113823"],"related":[],"title":"Azure CycleCloud: path traversal lets attackers read files over network","description":"Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an unauthorized attacker to disclose information over a network.","summary":"Azure CycleCloud has a path traversal flaw that lets an unauthorized attacker reach files outside the intended directory. The attacker can disclose information over the network.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Azure CycleCloud","fixed":["8.10.1"],"affected":">= 8.9.2, < 8.10.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["azure","azure-cyclecloud","self-hosted","vendor"],"not_affected_if":[],"how_to_check":"Check your Azure CycleCloud version (shown in the web UI About page). Versions >= 8.9.2 and < 8.10.1 are listed as affected; the CycleCloud web interface must be reachable over a network.","fix":"Upgrade Azure CycleCloud to 8.10.1 (per Microsoft CNA data in NVD; MSRC page not readable, release notes do not list this CVE)","status":"open","published_at":"2026-11-10T19:19:04+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","triaged_at":"2026-11-10T19:45:05+00:00","updated_at":"2026-11-10T23:51:25+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T19:45:05Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Azure CycleCloud: path traversal lets attackers read files over network","impact":"low","summary":"Azure CycleCloud has a path traversal flaw that lets an unauthorized attacker reach files outside the intended directory. The attacker can disclose information over the network.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["azure-cyclecloud","azure"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthorized attacker reads information from files over the network","analyst_note":"Find the affected version ranges and fixed version in the NVD entry or Microsoft advisory for CVE-2026-113823, and any checks for CycleCloud.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running Azure CycleCloud that expose its interface on a network are the ones this describes. The sources do not say which versions are affected or which configuration is required. unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000651,"input_tokens":4509,"output_tokens":401,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected version ranges and fixed version in the NVD entry or Microsoft advisory for CVE-2026-113823, and any checks for CycleCloud.","search":"'-113823':13A,16A '-2026':12A,15A 'allow':67C 'attack':6A,38B,46B,70C 'azur':1A,19B,21B,27B,65C 'azure':17A 'azure-cyclecloud':20B 'cve':11A,14A 'cyclecloud':2A,18A,22B,28B,66C 'directori':44B,61C 'disclos':48B,72C 'file':8A,40B 'flaw':33B 'host':25B 'improp':53C 'inform':49B,73C 'intend':43B 'let':5A,35B 'limit':54C 'network':10A,52B,76C 'outsid':41B 'path':3A,31B,62C 'pathnam':57C 'reach':39B 'read':7A 'restrict':60C 'self':24B 'self-host':23B 'travers':4A,32B,63C 'unauthor':37B,69C 'vendor':26B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Azure CycleCloud 8.9.2 up to (not including) 8.10.1 whose instance can be reached over a network. Microsoft rates it as needing no authentication or user interaction, with high confidentiality impact (read files outside the intended directory). Teams already on 8.10.1 or later, or whose instance is not network reachable, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["azurecyclecloud","cyclecloud"],"ptokens":["azure","cyclecloud"],"labels":["azure","azurecyclecloud","high","selfhosted","vendor"],"campaign_type":null,"search_a":"'-113823':13A,16A '-2026':12A,15A 'attack':6A 'azur':1A 'azure':17A 'cve':11A,14A 'cyclecloud':2A,18A 'file':8A 'let':5A 'network':10A 'path':3A 'read':7A 'travers':4A","search_b":"'attack':38B,46B 'azur':19B,21B,27B 'azure-cyclecloud':20B 'cyclecloud':22B,28B 'directori':44B 'disclos':48B 'file':40B 'flaw':33B 'host':25B 'inform':49B 'intend':43B 'let':35B 'network':52B 'outsid':41B 'path':31B 'reach':39B 'self':24B 'self-host':23B 'travers':32B 'unauthor':37B 'vendor':26B","search_c":"'allow':67C 'attack':70C 'azur':65C 'cyclecloud':66C 'directori':61C 'disclos':72C 'improp':53C 'inform':73C 'limit':54C 'network':76C 'path':62C 'pathnam':57C 'restrict':60C 'travers':63C 'unauthor':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113823","severity":null,"published_at":"2026-11-10T19:19:04+00:00","modified_at":"2026-11-10T19:19:04+00:00","first_seen_at":"2026-11-10T19:24:42+00:00","fetched_at":"2026-11-10T19:24:42+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113823:3243","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113823","severity":null,"published_at":"2026-11-10T23:51:25+00:00","modified_at":"2026-11-10T23:51:25+00:00","first_seen_at":"2026-11-10T23:51:25+00:00","fetched_at":"2026-11-10T23:51:25+00:00","note":"Affected 8.9.2 to <8.10.1, fixed 8.10.1, from Microsoft CNA data on NVD. MSRC page is JS-only and was not read; release notes 8.10.1 do not list this CVE, so nothing marked verified. No exploitation known.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-113823","https://learn.microsoft.com/en-us/azure/cyclecloud/release-notes/8-10-1?view=cyclecloud-8"]}],"documents":[{"id":120471,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113823","title":"NVD CVE-2026-113823 (Microsoft CNA data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":120424,"url":"https://learn.microsoft.com/en-us/azure/cyclecloud/release-notes/8-10-1?view=cyclecloud-8","title":"Azure CycleCloud release notes v8.10.1","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}