CVE-2026-58279 — Azure CycleCloud Elevation of Privilege Vulnerability

Executive Summary

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

Overview

6.5

CVSS MEDIUM

Important

MS Severity

Not Exploited

MS Exploit Status

Less Likely

MS Exploit Likelihood

Category Elevation of Privilege

Weakness CWE-862: Missing Authorization

Released Jul 14 2026

Last Updated Jul 14 2026

Publicly Disclosed No

CISA KEV Not Listed

Known Exploits None Known

EPSS Score 0.00362 — 0.29198 percentile

NVD CVSS 6.5 MEDIUM — matches MSRC

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:P/RL:O/RC:C

ATTACK VECTOR

Network

ATTACK COMPLEXITY

Low

PRIVILEGES REQUIRED

Low

USER INTERACTION

None

SCOPE

Unchanged

CONFIDENTIALITY

None

INTEGRITY

High

AVAILABILITY

None

EXPLOIT CODE MATURITY

Proof-of-Concept

REMEDIATION LEVEL

Official Fix

REPORT CONFIDENCE

Confirmed

Temporal Score: 5.9

EPSS Score

0.00362

probability of exploitation in the next 30 days

0.29198 percentile - updated 2026-08-14

View on FIRST.org

Exploits & PoC

No public exploit or PoC has been linked for this CVE yet. When available, references are sourced from public repositories and may be unverified or non-functional — review carefully before use.

Detection Rules

No public Sigma or Nuclei detection rule has been mapped to this CVE yet. Coverage is concentrated on exploited / high-profile vulnerabilities; check SigmaHQ for updates.

Acknowledgments

XBREACH.AI TEAM with https://xbreach.ai/

References

MSRC Advisory MITRE NVD