MicrosoftCVE-2026-70340

Microsoft Azure CycleCloud 8.9.1: missing authorization

High8.1CVE-2026-70340 · Published Aug 11, 2026 · updated Aug 17, 2026

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

Microsoft advisory

Affected versions

Package	Affected	Fixed in
Azure CycleCloud 8.9.1 Product	>= 1.0.0, < 8.9.1	8.9.1

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-862

More Microsoft advisories

Date	Advisory	Severity	Fixed in
Aug 11	Copilot Chat Security Feature Bypass Vulnerability High7.1Aug 11 CVE-2026-656751.132.1	High7.1	1.132.1
Aug 11	Copilot Custom Agent Hook Remote Code Execution Vulnerability High7.8Aug 11 CVE-2026-703351.132.1	High7.8	1.132.1
Aug 11	Information disclosure vulnerability MediumAug 11 CVE-2026-472851.132.1	Medium	1.132.1
Aug 11	Fileless RCE in VS Code Web Remote Terminal via URL-Controlled NODE_OPTIONS High8.8Aug 11 CVE-2026-703361.132.1	High8.8	1.132.1
Aug 11	Visual Studio Code web deployments - environmentService.ts - RCE via NODE_OPTIONS --import from URL payload High8.8Aug 11 CVE-2026-693201.132.1	High8.8	1.132.1
Aug 11	TerminalInstance._createProcess - Workspace Trust bypass via terminal waitOnExit High7.8Aug 11 CVE-2026-692781.132.1	High7.8	1.132.1

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.