Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
10.0
CVE-2026-65770: Azure Managed Cassandra can let attackers run code remotely
CVE-2026-65770 · published 14 days ago
Summary
The Azure Managed Instance for Apache Cassandra does not properly handle special characters in commands, which could let an unauthorized user send crafted requests and cause the system to run their code. This could lead to data loss, service disruption, or further compromise of your environment. Apply the latest security update from Microsoft as soon as possible to fix the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| microsoft | azure managed instance for apache cassandra | - |
Original advisory text
Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability
Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network.
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65770 vendor-advisory patch
Severity
10.0
Critical
CVSS 3.1: 10.0 (MITRE)
Exploitation
EPSS <1%
Type
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Timeline
Published20 Aug 2026
Updated3 Sep 2026
First seen20 Aug 2026
Monitor software like this
Free during beta