CVE-2026-100207
HIGH(7.3)CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- CVSS 7.3 — Hoch
Erwähnungen (letzte 60 Tage)
EPSS-Score
0.4%
Exploit-Wahrscheinlichkeit (30 Tage)
CVSS Score
7.3
Technische Schwere
Beschreibung
Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.
Erkennung & Indikatoren
Ausnutzung
In den geprüften Quellen nicht genannt
Behobene Versionen
- Azure CycleCloud 8.9.2
Threat-Hunting-Queries
Detects attempts to execute OS commands via Azure CycleCloud. Focus on process creation events originating from the Azure CycleCloud application.
Sentinel/Defender KQL
DeviceProcessEvents
| where InitiatingProcessFileName =~ "CycleCloud.exe"
| where FileName in ("cmd.exe", "powershell.exe", "sh", "bash")
| where ProcessCommandLine contains "/c" or ProcessCommandLine contains "-c" or ProcessCommandLine contains "-Command"Splunk SPL
index=* sourcetype=WinEventLog:Security EventCode=4688 NewProcessName IN ("cmd.exe", "powershell.exe") ParentProcessName="CycleCloud.exe" CommandLine IN ("* /c *", "* -c *", "* -Command *")Sigma
title: Azure CycleCloud OS Command Injection
status: experimental
description: Detects OS command injection attempts via Azure CycleCloud.
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: '\CycleCloud.exe'
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\sh'
- '\bash'
condition: selectionElastic ES|QL
from process where process.parent.executable.full_path : "*\\CycleCloud.exe" and process.executable.full_path : ("*\\cmd.exe", "*\\powershell.exe", "*\\sh", "*\\bash") and process.args : ("/c", "-c", "-Command")SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.