CVE-2024-43602: Azure CycleCloud Remote Code Execution Vulnerability

Critical severity · published Nov 12, 2024

CVE-2024-43602

Azure CycleCloud Remote Code Execution Vulnerability

9.9

CVSS

2.3%

EPSS

On KEV

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)2.3% · higher than 83% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Azure CycleCloud · Microsoft

8.6.3 before 8.6.5; 8.6.4 before 8.6.5; 8.6.0 before 8.6.5 · source: vendor, NVD

Azure CycleCloud 8.0.0 · Microsoft

8.0.0 before 8.6.5 · source: vendor

Azure CycleCloud 8.0.1 · Microsoft

8.0.0 before 8.6.5 · source: vendor

Azure CycleCloud 8.0.2 · Microsoft

8.0.0 before 8.6.5 · source: vendor

Azure CycleCloud 8.1.0 · Microsoft

8.1.0 before 8.6.5 · source: vendor

Azure CycleCloud 8.1.1 · Microsoft

8.1.0 before 8.6.5 · source: vendor

Azure CycleCloud 8.2.0 · Microsoft

8.2.0 before 8.6.5 · source: vendor

Azure CycleCloud 8.2.1 · Microsoft

8.2.0 before 8.6.5 · source: vendor

Azure CycleCloud 8.2.2 · Microsoft

8.2.0 before 8.6.5 · source: vendor

Azure CycleCloud 8.3.0 · Microsoft

8.3.0 before 8.6.5 · source: vendor

Azure CycleCloud 8.4.0 · Microsoft

8.4.0 before 8.6.5 · source: vendor

Azure CycleCloud 8.4.1 · Microsoft

8.4.0 before 8.6.5 · source: vendor

Affected product

Azure CycleCloud

Microsoft

All Azure CycleCloud CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-43602

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-43602

Patch

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43602