Security Updates for Azure CycleCloud < 8.9.2 (August 2026)

high Nessus Plugin ID 335450

Synopsis

The Azure CycleCloud product is affected by multiple vulnerabilities.

Description

The Azure CycleCloud product is missing a security update. It is, therefore, affected by the following vulnerabilities:

- Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. (CVE-2026-70340)

- Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network. (CVE-2026-65806)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Microsoft has released CycleCloud version 8.9.2 to address this issue.

Plugin Details

Severity: High

ID: 335450

File Name: azure_cyclecloud_8_9_2.nasl

Version: 1.1

Type: Remote

Family: Web Servers

Published: 8/14/2026

Updated: 8/14/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.59

CVSS v2

Risk Factor: High

Base Score: 8.5

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:C/A:C

CVSS Score Source: CVE-2026-70340

CVSS v3

Risk Factor: High

Base Score: 8.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Vulnerability Information

CPE: cpe:/a:microsoft:azure_cyclecloud

Required KB Items: installed_sw/Microsoft Azure CycleCloud

Patch Publication Date: 8/11/2026

Vulnerability Publication Date: 8/11/2026

Reference Information

CVE: CVE-2026-65806, CVE-2026-70340

IAVA: 2026-A-0848

Detections

Analytics