Microsoft Azure CycleCloud: Path traversal leading to information disclosure
Summary
Azure CycleCloud, a tool for orchestrating High Performance Computing environments on Azure, contains a path traversal flaw (CWE-22) that allows an unauthorized remote attacker to read information they should not access. The CVSS vector indicates no authentication or user interaction is required and the impact is limited to confidentiality. Exposure is highest for CycleCloud instances reachable from the internet or untrusted networks.
Affected
- Microsoft Azure CycleCloud 8.9.2 to before 8.10.1 (per the CVE record)
- Whether earlier releases are affected: Unknown.
Fixed in
- Upgrade to Azure CycleCloud 8.10.1 (per the CVE record and vendor documentation; MSRC advisory not verified directly).
Workaround
- No vendor workaround found.
- Until upgraded, restrict network access to the CycleCloud web interface (general measure, not a vendor statement).
Exploitation
- Rapid7 lists exploitation as less likely and publicly disclosed as "No".
- CISA SSVC: Exploitation none, automatable yes.
- Not listed in CISA KEV according to Strix (third-party, verify on CISA).
- No public proof of concept or exploit reports found. The CVE is very recent.
Our recommendation
- Check whether Azure CycleCloud is in use; if not, no action is needed.
- If in use, verify the installed version and upgrade to 8.10.1, starting with internet-reachable instances.
- Restrict access to the CycleCloud web interface to trusted networks until patched.
- Monitor for unusual requests and verify the fix against the MSRC advisory.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-113823 msrc.microsoft.com
- CVE Record CVE-2026-113823 www.cve.org
- Strix: CVE-2026-113823 www.strix.ai
- Rapid7: Patch Tuesday November 2026 www.rapid7.com
- Azure CycleCloud overview learn.microsoft.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:53.
Original description (NVD)
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.