CVE-2026-88094
8.1HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on integrity, availability
- Weakness
- CWE-74
Impact
An authenticated network attacker can elevate privileges and tamper with or disrupt downstream Azure Storage operations. They need valid low-privileged credentials and direct network access to the target service.
Root cause
Improper neutralization of special elements in downstream output allows command or query injection in the Azure Storage Library.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Fix & remediation
Review the Microsoft Security Response Center advisory (CVE-2026-88094) for the target fixed library release and update your application dependencies; restrict low-privileged role access in the interim.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges over a network.