{"dataType":"CVE_RECORD","dataVersion":"5.0","cveMetadata":{"cveId":"GCVE-110-NCSC-2026-475","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-11-10T19:59:23Z","dateUpdated":"","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"nl","value":"An authorization bypass vulnerability in Azure DevOps Server allows an authorized attacker to elevate privileges over a network by exploiting a user-controlled key.","supportingMedia":null},{"lang":"nl","value":"An OS command injection vulnerability in Azure CycleCloud allows authorized attackers to execute arbitrary OS commands and escalate privileges over a network due to improper neutralization of special elements in OS commands.","supportingMedia":null},{"lang":"nl","value":"An untrusted search path vulnerability in the Azure NFS mount helper (aznfs) allows an authorized local attacker to elevate privileges on the affected system.","supportingMedia":null},{"lang":"nl","value":"An incorrect permission assignment in Azure Local allows an authorized attacker to elevate their privileges locally, posing a significant security risk.","supportingMedia":null},{"lang":"nl","value":"An authorized attacker can exploit improper neutralization of special elements in Azure CLI's OS commands to execute code remotely, posing a significant security risk.","supportingMedia":null},{"lang":"nl","value":"An improper certificate revocation check in Azure Firmware enables an authorized attacker to locally bypass a security feature, potentially compromising system integrity.","supportingMedia":null},{"lang":"nl","value":"Improper authentication in Azure DevOps allows an authorized attacker to remotely execute code over a network, posing significant security risks.","supportingMedia":null},{"lang":"nl","value":"A server-side request forgery (SSRF) vulnerability in Azure DevOps Server allows an authorized attacker to disclose sensitive information over a network.","supportingMedia":null},{"lang":"nl","value":"A missing authorization vulnerability in Azure CycleCloud allows an authorized attacker to elevate privileges over a network, potentially compromising system integrity.","supportingMedia":null},{"lang":"nl","value":"Azure CycleCloud contains a path traversal vulnerability that enables unauthorized attackers to disclose sensitive information over a network.","supportingMedia":null},{"lang":"nl","value":"An issue in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network without an assigned CWE identifier.","supportingMedia":null},{"lang":"nl","value":"A path traversal vulnerability in Azure CycleCloud allows authorized users to bypass directory restrictions and escalate privileges locally.","supportingMedia":null},{"lang":"nl","value":"An incorrect permission assignment in Azure File Sync allows an authorized attacker to locally elevate their privileges by exploiting a critical resource misconfiguration.","supportingMedia":null},{"lang":"nl","value":"Incorrect permission assignment in Azure Front Door (AFD) allows unauthorized attackers to escalate privileges within a network, posing a significant security risk.","supportingMedia":null},{"lang":"nl","value":"Improper neutralization of special elements in Azure Pipelines can result in command injection vulnerabilities, enabling authorized attackers to execute remote code.","supportingMedia":null},{"lang":"nl","value":"A missing authentication vulnerability in Azure OpenAI allows unauthorized attackers to escalate privileges across a network, posing significant security risks.","supportingMedia":null},{"lang":"nl","value":"Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges remotely over a network, posing a significant security risk.","supportingMedia":null},{"lang":"nl","value":"A missing authorization vulnerability in Azure Confidential Clean Rooms allows an authorized attacker to tamper with data transmitted over a network.","supportingMedia":null},{"lang":"nl","value":"Improper privilege management in Microsoft Azure Kubernetes Service enables an authorized attacker to locally elevate their privileges, potentially compromising system integrity.","supportingMedia":null}],"references":[{"url":"https://advisories.ncsc.nl/csaf/v2/2026/ncsc-2026-0475.json","name":"","tags":["advisory"]},{"url":"https://portal.msrc.microsoft.com/en-us/security-guidance","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-85923.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-102224.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-105494.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-105734.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-109457.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-109462.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-109467.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-112745.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-113822.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-113823.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-114160.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-114161.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118288.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118742.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-119989.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-119990.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-120783.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-121668.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-122986.json","name":"","tags":["advisory"]}],"metrics":[{"format":"","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C","baseScore":7.7,"baseSeverity":"HIGH"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Authorization Bypass Through User-Controlled Key","cweId":"CWE-639","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Neutralization of Special Elements used in an OS Command","cweId":"CWE-78","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Untrusted Search Path","cweId":"CWE-426","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Incorrect Permission Assignment for Critical Resource","cweId":"CWE-732","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Check for Certificate Revocation","cweId":"CWE-299","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Server-Side Request Forgery","cweId":"CWE-918","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Missing Authorization","cweId":"CWE-862","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Limitation of a Pathname to a Restricted Directory","cweId":"CWE-22","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Improper Neutralization of Special Elements used in a Command","cweId":"CWE-77","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Missing Authentication for Critical Functionality","cweId":"CWE-306","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Weak Authentication","cweId":"CWE-1390","type":"CWE"}]}],"affected":[{"vendor":"Microsoft","product":"vers:unknown/*","collectionURL":"","packageName":"","repo":"","defaultStatus":"","versions":null,"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null,"x_vulnetix_aliases":{"direct":["CVE-2026-102224","CVE-2026-105494","CVE-2026-105734","CVE-2026-109457","CVE-2026-109462","CVE-2026-109467","CVE-2026-112745","CVE-2026-113822","CVE-2026-113823","CVE-2026-114160","CVE-2026-114161","CVE-2026-118288","CVE-2026-118742","CVE-2026-119989","CVE-2026-119990","CVE-2026-120783","CVE-2026-121668","CVE-2026-122986","CVE-2026-85923"]}},"adp":null}}