CVE-2026-70340 is a high severity (CVSS 8.1) missing authorization flaw in Microsoft Azure CycleCloud. An authorized attacker can elevate privileges over a network. The fix is the update named in the Microsoft Security Response Center entry. The record gives no version numbers, so confirm your build against that page.
What's affected
The record names Microsoft Azure CycleCloud and describes missing authorization, tracked as CWE-862, allowing an authorized attacker to elevate privileges over a network.
The vector is AV:N/AC:L/PR:L/UI:N: reachable over the network, low complexity, a low privilege account required, and no user interaction. Integrity and availability impacts are rated high, confidentiality none.
I could not read the MSRC page, which loads its content by script, so I cannot state which CycleCloud versions are affected or fixed. Check the advisory for the build table.
How to check if you're exposed
CycleCloud is a self-managed application you deploy in your own subscription, so the version is yours to look up. In the web UI, the version shows in the About information. You can also check it from the host where the application runs, following Microsoft's documentation for your install type.
Then compare against the fixed version named in MSRC.
Because the flaw needs a valid account, also look at who holds one. List the users and roles in your CycleCloud instance and remove accounts that are no longer needed. Limit network reachability of the web interface to the networks that need it, using network security groups.
free in-browser dependency scan is useful for the applications you build around cluster tooling, but it does not replace checking the CycleCloud build itself.
What to do now
- Read the MSRC entry for CVE-2026-70340 and note the fixed CycleCloud version.
- Find every CycleCloud instance in your subscriptions and record its version.
- Upgrade to the fixed version following Microsoft's upgrade guidance.
- Review accounts and roles, and remove access that is not needed.
- Restrict network access to the CycleCloud interface to known management networks.
Why it matters
CWE-862 means a function does not check whether the caller is allowed to use it. The caller is signed in, but the application never asks if they should be allowed. These flaws are common in applications with many roles, because each new action needs its own check and one missing check is enough.
The low privilege requirement is the key detail. Any account, including one issued to a contractor or a short term project, becomes a starting point for higher access. Cluster orchestration tools often hold credentials for compute resources, so privilege inside them can reach further than the tool itself.
Quick check
Does an attacker need an account?
Yes. The vector requires low privileges, and the description calls the attacker authorized. Reducing who has accounts and limiting network reach lowers the risk until you patch.
Sources
Last reviewed: 18 October 2026.
