CVE-2026-109457

Connecting to a shared Azure ML job could run commands on the user's machine

Microsoft · Azure CLI machine-learning extension

First documented disclosure · Review checkpoint

Summary

The CLI did not safely separate job-controlled values from operating-system commands. Code could run with the connecting user’s local permissions.

Severity and exploitation evidence

High · 8.0/10 · CVSS 3.1. Severity source.

Exploitation not established: Microsoft marked exploitation as No at publication.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The CLI did not safely separate job-controlled values from operating-system commands.

Conditions required

A user with permission to submit jobs in a shared workspace persuaded another user to connect to a job.

Potential impact

Code could run with the connecting user’s local permissions.

Affected versions and configurations

Microsoft identifies the Azure ML extension. The CNA's range starts above its listed fix, leaving the minimum affected release unclear.

Fix and mitigation status

2.45.1 of the ml extension, per MSRC.

Practical next steps

Update the Azure CLI machine-learning extension to 2.45.1 or later.

Operating lesson

Track the deployed SDK, extension or managed service when applying Microsoft’s remediation.

Evidence and limits

The CVE record was published on 2026-11-10.

Sources