PT-2026-2765 · Microsoft · Azure Core

Muhammad Fadilullah Dzaki · Published 2026-01-13 · Updated 2026-01-20 · CVE-2026-21226

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Azure Core shared client library for Python (affected versions not specified)

Description The deserialization of untrusted data in the Azure Core shared client library for Python allows an authorized attacker to execute code over a network. This flaw enables an attacker with network access to potentially achieve remote code execution (RCE).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2026-00805

CVE-2026-21226

Affected Products

Azure Core

References · 8

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21226 · Security Note
• https://bdu.fstec.ru/vul/2026-00805 · Security Note
• https://t.me/cveNotify/149315 · Telegram Post
• https://dbugs.ptsecurity.com/vulnerability/PT-2026-2765 · Note
• https://twitter.com/0dayPublishing/status/2011146488936583393 · Twitter Post
• https://twitter.com/_cvereports/status/2011348263144751152 · Twitter Post
• https://twitter.com/CVEnew/status/2011142882871099609 · Twitter Post