PT-2026-2765 · Microsoft · Azure Core

Muhammad Fadilullah Dzaki · Published 2026-01-13 · Updated 2026-03-01 · CVE-2026-21226

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

High

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Azure Core shared client library for Python (affected versions not specified)

Description The deserialization of untrusted data in the Azure Core shared client library for Python allows an authorized attacker to execute code over a network. This flaw enables an attacker with network access to potentially achieve remote code execution (RCE).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2026-00805

CVE-2026-21226

GHSA-JM66-CG57-JJV5

OPENSUSE-SU-2026:10161-1

OPENSUSE-SU-2026:20292-1

SUSE-SU-2026:0476-1

SUSE-SU-2026:20617-1

SUSE-SU-2026:20621-1

Affected Products

Azure Core

References · 25

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21226 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21226 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0476-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20617-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20621-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2026-21226 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10161-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jm66-cg57-jjv5 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00805 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21226 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20292-1 · Vendor Advisory
• https://github.com/Azure/azure-sdk-for-python/blob/6d2e6431ea0991861640e449e51e894247a7771a/sdk/core/azure-core/CHANGELOG.md#1380-2026-01-12 · Note
• https://github.com/Azure/azure-sdk-for-python · Note
• https://dbugs.ptsecurity.com/vulnerability/PT-2026-2765 · Note
• https://t.me/cveNotify/149315 · Telegram Post