{"id":"CVE-2026-21531","aliases":["EUVD-2026-7338","GHSA-436v-jg82-p533","PYSEC-2026-289"],"status":"published","title":"Azure SDK for Python Remote Code Execution Vulnerability","description":"Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.02542,"percentile":0.85196,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-502"],"published":"2026-02-10T17:51:31Z","modified":"2026-10-27T15:30:04Z","exploits":[{"source":"pocgithub","id":"NetVanguard-cmd/CVE-2026-21531","title":"NetVanguard-cmd/CVE-2026-21531","date":"2026-02-11","url":"https://github.com/NetVanguard-cmd/CVE-2026-21531"}],"fixes":[{"ecosystem":"PyPI","package":"azure-ai-language-conversations-authoring","fixed_in":["1.0.0b4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"azure-ai-language-conversations-authoring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0b4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"azure-ai-language-conversations-authoring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0b4"}]}],"versions":["1.0.0b1","1.0.0b2","1.0.0b3"]},{"source":"osv","ecosystem":"PyPI","package":"azure-ai-language-conversations-authoring","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0b4"}]}],"versions":["1.0.0b1","1.0.0b2","1.0.0b3"]}],"products":[{"vendor":"microsoft","product":"azure ai language authoring"},{"vendor":"microsoft","product":"azure_conversation_authoring_client_library"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21531","tags":["vendor-advisory","patch","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21531","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/azure-ai-language-conversations-authoring/PYSEC-2026-289.yaml","tags":["web"]},{"url":"https://pypi.org/project/azure-ai-language-conversations-authoring","tags":["web","package"]},{"url":"https://github.com/advisories/GHSA-436v-jg82-p533","tags":["advisory"]},{"url":"https://github.com/Azure/azure-sdk-for-python","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-21531","title":"Azure SDK for Python Remote Code Execution Vulnerability","description":"Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.","status":"published","published":"2026-02-10T17:51:31.66Z","modified":"2026-08-19T16:26:02.015Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"critical","assessor":"cna"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T13:41:42.05254Z"}],"euvd":[{"id":"EUVD-2026-7338","description":"Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.","status":"published","published":"2026-02-10T17:51:31Z","modified":"2026-08-19T16:26:02Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","level":"critical"}],"updated_at":"2026-11-02T18:01:44.172516Z"}],"ghsa":[{"id":"GHSA-436v-jg82-p533","title":"Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE","description":"Deserialization of untrusted data in the Azure AI Language Conversations Authoring client library for Python allows an unauthorized attacker to execute code over a network.","status":"published","published":"2026-02-10T18:30:42Z","modified":"2026-10-27T15:21:49Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:41:37.912288Z"}],"nvd":[{"id":"CVE-2026-21531","description":"Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.","status":"published","published":"2026-02-10T18:16:35.58Z","modified":"2026-06-17T10:18:47.72Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T14:12:05.908608Z"}],"osv":[{"id":"GHSA-436v-jg82-p533","title":"Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE","description":"Deserialization of untrusted data in the Azure AI Language Conversations Authoring client library for Python allows an unauthorized attacker to execute code over a network.","status":"published","published":"2026-02-10T18:30:42Z","modified":"2026-10-27T15:30:04.364585856Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-502"],"updated_at":"2026-11-02T15:46:36.434231Z"},{"id":"PYSEC-2026-289","title":"Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE","description":"Deserialization of untrusted data in the Azure AI Language Conversations Authoring client library for Python allows an unauthorized attacker to execute code over a network.","status":"published","published":"2026-06-29T11:50:51.457063Z","modified":"2026-07-01T20:22:49.625745Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:56.429374Z"}]}}