CVE-2026-77909

Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network.

Scoring

Severity

HIGH

CVSS base score

7.7

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C

CWE

CWE-522

Published

2026-09-08

Last modified

2026-09-09

Affected products

• Microsoft Azure CycleCloud 8.9.2

Weakness type

• CWE-522

Related vulnerabilities

• CVE-2026-69805 — .NET Elevation of Privilege Vulnerability
• CVE-2026-64918 — Microsoft Office Spoofing Vulnerability
• CVE-2026-81381 — GitHub Copilot and Visual Studio Code Information Disclosure Vulnerability
• CVE-2026-82070 — Insufficiently Protected Credentials in MongoDB Server Diagnostic Reporting Interface
• CVE-2026-86600 — Workload identity attestation generated before login host validation in Snowflake drivers
• CVE-2026-86726 — AVideo through 29.0 Information Disclosure via restreamsActive.json.php
• CVE-2026-61516 — Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint
• CVE-2026-76969 — Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)

Markdown version · Browse all CVEs