CVE-2026-21226 Azure Core shared client library for Python Remote Code Execution Vulnerability
An authorized attacker can execute arbitrary code remotely via unsafe deserialization in the Azure Core Python library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-21226?
CVE-2026-21226 is a high-severity unsafe deserialization vulnerability in Microsoft Azure Core shared client library for Python, published on 13 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network.
Weakness: CWE-502
Which versions are affected by CVE-2026-21226?
3 open source packages ship an affected version, including azure-core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
azure-core PyPI | All versions | 1.38.0 |
azure-core PyPI | All versions | 1.38.0 |
azure-core PyPI | All versions | 1.38.0 |
Linux distribution packages (9)
python-azure-core SUSE:Linux Enterprise High Availability Extension 16.0 | All versions | 1.32.0-160000.3.1 |
python-azure-core SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 1.30.0-150400.11.6.1 |
python-azure-core SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | All versions | 1.30.0-150400.11.6.1 |
python-azure-core SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | All versions | 1.30.0-150400.11.6.1 |
python-azure-core SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | All versions | 1.30.0-150400.11.6.1 |
python-azure-core SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 1.32.0-160000.3.1 |
python-azure-core openSUSE:Leap 15.6 | All versions | 1.30.0-150400.11.6.1 |
python-azure-core openSUSE:Leap 16.0 | All versions | 1.32.0-160000.3.1 |
python-azure-core openSUSE:Tumbleweed | All versions | 1.38.0-2.1 |
Products include Microsoft Azure Core Shared Client Library.
How do I fix CVE-2026-21226?
Upgrade azure-core to 1.38.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-21226 being exploited?
There is no known exploitation of CVE-2026-21226 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-DQ66117, CLEANSTART-2026-RG68334, ECHO-8823-3581-0fe0, GHSA-jm66-cg57-jjv5, MINI-cpgh-8xpx-ff7v, MINI-pf9c-2339-w953 and 10 more.