PT-2026-7411 · Microsoft · Azure Ai Language Authoring

Muhammad Fadilullah Dzaki · CVE-2026-21531 · Published 2026-02-10 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Azure AI Language Authoring SDK version 1.0.0

Description A flaw exists in the Azure AI Language Authoring SDK that allows an unauthorized attacker to execute code over a network. This is due to the deserialization of untrusted data. The issue is categorized as a remote code execution condition.

Recommendations Restrict access to the Azure AI Language Authoring SDK version 1.0.0. Monitor systems utilizing the Azure AI Language Authoring SDK version 1.0.0 for suspicious activity.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2026-01788

CVE-2026-21531

GHSA-436V-JG82-P533

PYSEC-2026-289

Affected Products

Azure Ai Language Authoring

References · 12

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21531 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-289 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-436v-jg82-p533 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21531 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21531 · Security Note
• https://bdu.fstec.ru/vul/2026-01788 · Security Note
• https://github.com/Azure/azure-sdk-for-python · Note
• https://twitter.com/OstorlabSec/status/2021607888972574855 · Twitter Post
• https://pypi.org/project/azure-ai-language-conversations-authoring · Note
• https://twitter.com/johnboston35100/status/2026826297666658373 · Twitter Post
• https://twitter.com/offseq/status/2021418962127335709 · Twitter Post
• https://github.com/advisories/GHSA-436v-jg82-p533 · Note