Security Updates for Azure CycleCloud < 8.9.1

critical Nessus Plugin ID 335451

Synopsis

The Azure CycleCloud product is affected by multiple vulnerabilities.

Description

The Azure CycleCloud product is missing a security update. It is, therefore, affected by the following vulnerabilities:

- Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. (CVE-2026-57969)

- An improper input validation vulnerability exists in Apache Tomcat. (CVE-2026-41293)

- An authentication bypass vulnerability exists in digest authentication in Apache Tomcat.
(CVE-2026-43512)

- An improper handling of case sensitivity vulnerability exists in LockOutRealm in Apache Tomcat.
(CVE-2026-43513)

- An allocation of resources without limits or throttling vulnerability exists in Apache Tomcat.
(CVE-2026-41284)

- An HTTP authentication header can be exposed to unexpected hosts during WebSocket authentication in Apache Tomcat. (CVE-2026-42498)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Microsoft has released CycleCloud version 8.9.1 to address this issue.

Plugin Details

Severity: Critical

ID: 335451

File Name: azure_cyclecloud_8_9_1.nasl

Version: 1.1

Type: Remote

Family: Web Servers

Published: 8/14/2026

Updated: 8/14/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.12

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-41293

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:microsoft:azure_cyclecloud

Required KB Items: installed_sw/Microsoft Azure CycleCloud

Patch Publication Date: 7/8/2026

Vulnerability Publication Date: 5/12/2026

Reference Information

CVE: CVE-2026-41284, CVE-2026-41293, CVE-2026-42498, CVE-2026-43512, CVE-2026-43513, CVE-2026-57969

IAVA: 2026-A-0848

Detections

Analytics