{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21522", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2025-12-30T18:10:54.846Z", "datePublished": "2026-02-10T17:51:29.618Z", "dateUpdated": "2026-05-11T21:25:27.651Z"}, "containers": {"cna": {"title": "Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability", "datePublic": "2026-02-10T16:00:00.000Z", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:microsoft_aci_confidential_containers:*:*:*:*:*:*:*:*", "versionStartIncluding": "1.0.0", "versionEndExcluding": "1.2.8"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft ACI Confidential Containers", "versions": [{"version": "1.0.0", "lessThan": "1.2.8", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "lang": "en-US", "type": "CWE", "cweId": "CWE-77"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-05-11T21:25:27.651Z"}, "references": [{"name": "Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "patch"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21522"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 6.7, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21522", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T04:55:41.750380Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:44:46.504Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21522", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T04:55:41.750380Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:43:15.556Z"}}], "cna": {"title": "Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 6.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft ACI Confidential Containers", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "1.2.8", "versionType": "custom"}]}], "datePublic": "2026-02-10T16:00:00.000Z", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21522", "name": "Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "patch"]}], "descriptions": [{"lang": "en-US", "value": "Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privileges locally."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:microsoft_aci_confidential_containers:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.2.8", "versionStartIncluding": "1.0.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2026-05-11T18:10:08.154Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21522", "state": "PUBLISHED", "dateUpdated": "2026-05-11T18:10:08.154Z", "dateReserved": "2025-12-30T18:10:54.846Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2026-02-10T17:51:29.618Z", "assignerShortName": "microsoft"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:confcom:*:*:*:*:*:azure_cli:*:*", "matchCriteriaId": "1769C397-4AB8-4BCF-918C-BFF9E8E7B344", "versionEndExcluding": "1.2.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privileges locally."}], "id": "CVE-2026-21522", "lastModified": "2026-02-11T18:45:49.650", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Primary"}]}, "published": "2026-02-10T18:16:34.577", "references": [{"source": "secure@microsoft.com", "tags": ["Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21522"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "secure@microsoft.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,1.2.8)"}}], "product": "confidental_containers", "vendor": "microsoft"}], "analysis": {"en": {"generated_at": "2026-04-15T16:29:46.297326+00:00", "value": {"mitigation_remediation": ["Apply the latest Microsoft ACI Confidential Containers update provided in the Microsoft security advisory.", "Configure role\u2011based access controls to restrict command\u2011execution capabilities to only trusted administrators, limiting the attack surface for command injection.", "Validate or sanitize all command inputs in custom scripts or managed configuration templates to eliminate the insertion of shell metacharacters, addressing the underlying CWE\u201177 flaw.", "Monitor audit logs for anomalous command execution and review the integrity of the compute gallery images."], "summary": {"action": "Immediate Patch", "impact": "Local Privilege Escalation"}, "threat_synthesis": {"affected_systems": "The affected product is Microsoft ACI Confidential Containers, deployed through Azure Compute Gallery. No specific version numbers are listed in the current data, so all installations of this product remain potentially vulnerable until the vendor releases a patched build. Administrators should verify the exact component version and apply the update when available.", "description_and_impact": "Microsoft ACI Confidential Containers is affected by a command\u2011injection flaw that allows a user with sufficient authorization to inject malicious commands. The vulnerability arises from improper neutralization of special elements used in a command within Azure Compute Gallery. Exploitation enables an attacker to run arbitrary commands with elevated privileges on the local host, increasing the risk of further compromise or data exposure. This flaw is categorized as a classic command injection weakness (CWE\u201177).", "risk_and_exploitability": "The CVSS base score of 6.7 indicates moderate severity, and the EPSS score of less than 1\u202f% suggests that exploitation is unlikely to occur at the current time. The vulnerability is not listed in the CISA KEV catalog, and no public exploit has been reported. Based on the description, the likely attack vector is local authorization abuse; an attacker would likely need valid credentials or existing access to the Azure Compute Gallery repository to inject commands. Given the need for authenticated interaction, the overall risk to an isolated environment is moderate, but the potential impact of privilege escalation warrants prompt remediation."}}}}, "created": "2026-02-11T21:52:14.233252+00:00", "updated": "2026-04-15T17:45:10.823432+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$confidental_containers"]}