---
id: "CVE-2026-114161"
page: "https://infrastack.ai/live/CVE-2026-114161"
kind: "vulnerability"
aliases: ["CVE-2026-114161"]
title: "Azure CycleCloud: path traversal lets a local user gain higher privileges"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Azure CycleCloud", "fixed": ["8.10.1"], "affected": ">= 8.9.2, < 8.10.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["azure", "azure-cyclecloud", "infrastructure", "local-privilege-escalation", "path-traversal", "self-hosted"]
not_affected_if: ["no-cyclecloud", "version-8.10.1-or-later"]
published_at: "2026-11-10T19:19:09+00:00"
first_seen_at: "2026-11-10T19:24:44+00:00"
updated_at: "2026-11-10T23:42:03+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114161", "first_seen_at": "2026-11-10T19:24:44+00:00"}, {"source": "analyst", "url": "https://cveawg.mitre.org/api/cve/CVE-2026-114161", "first_seen_at": "2026-11-10T23:42:03+00:00", "cites": ["https://cveawg.mitre.org/api/cve/CVE-2026-114161", "https://learn.microsoft.com/en-us/azure/cyclecloud/release-notes/8-10-1?view=cyclecloud-8"]}]
exploit_sources: []
---

# Azure CycleCloud: path traversal lets a local user gain higher privileges

Link for people: https://infrastack.ai/live/CVE-2026-114161 (this .md is for agents)

Path traversal in Azure CycleCloud lets a user with local access and low privileges escalate privileges on the CycleCloud host. Microsoft's CVE record lists 8.9.2 as affected and 8.10.1 as the fixed release. No exploitation or public PoC found; CISA SSVC lists exploitation as none.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Azure CycleCloud affected >= 8.9.2, < 8.10.1 fixed 8.10.1

## How to check

Check the installed CycleCloud version (CycleCloud web UI About page, or the install on the host). Version 8.9.2 through anything below 8.10.1 is listed as affected. Microsoft's record does not say about versions before 8.9.2, so treat those as unconfirmed and upgrade anyway. Then review who has local login or shell access on the CycleCloud host.

## Fix

Upgrade Azure CycleCloud to 8.10.1 or later.

## Timeline

- 2026-11-10T19:24:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114161
- 2026-11-10T23:42:03+00:00 analyst https://cveawg.mitre.org/api/cve/CVE-2026-114161 — Microsoft CNA record: path traversal (CWE-22), affected 8.9.2 up to but excluding 8.10.1; CVSS 7.8 local, low privileges, no user interaction. CISA SSVC: no exploitation. MSRC page is JS-only and unread; 8.10.1 release notes do not name this CVE, so the fix version rests on the CNA range only. Cannot tell whether versions before 8.9.2 are affected.

## Documents

- [advisory] CVE-2026-114161 CNA record (Microsoft) https://cveawg.mitre.org/api/cve/CVE-2026-114161
- [fix] Azure CycleCloud release notes v8.10.1 https://learn.microsoft.com/en-us/azure/cyclecloud/release-notes/8-10-1?view=cyclecloud-8

## From the sources

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an authorized attacker to elevate privileges locally.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_