Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Azure AI Language authoring may let attackers run code

CVE-2026-21531 · published 8 months ago
Summary

The Python library used to create Azure AI Language conversation authoring can be tricked into processing fake data, allowing an outsider to run commands on your system. This could let a malicious user take control of the server that runs the library. Apply the latest updates from Microsoft or replace the library with the patched version as soon as possible.

What to do
  • Update microsoft corporation azure-ai-language-conversations-authoring to version 1.0.0b4.
  • Update azure-ai-language-conversations-authoring to version 1.0.0b4.
  • Update microsoft azure ai language authoring to version 1.0.0b4 or later.
Affected software
Ecosystem VendorProductAffected versions
pip microsoft corporation azure-ai-language-conversations-authoring < 1.0.0b4
Fix: upgrade to 1.0.0b4
– microsoft azure_conversation_authoring_client_library 1.0.0
cpe:2.3:a:microsoft:azure_conversation_authoring_client_library:1.0.0:beta1:*:*:*:python:*:*
– microsoft azure ai language authoring < 1.0.0b4
pip – azure-ai-language-conversations-authoring < 1.0.0b4
Fix: upgrade to 1.0.0b4
Original advisory text
Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE
Deserialization of untrusted data in the Azure AI Language Conversations Authoring client library for Python allows an unauthorized attacker to execute code over a network.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
Timeline
Published10 Feb 2026
Updated30 Oct 2026
First seen6 Mar 2026
Sources
CVE-2026-21531 · NVD
GHSA-436v-jg82-p533 · GHSA
CVE-2026-21531 · MITRE
Track software like this
Free during beta