CVE-2026-21522 Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability

Medium 6.7 Published 10 Feb 2026 Updated 19 Aug 2026

An authorized attacker can exploit command injection in Azure Compute Gallery to elevate privileges locally within Microsoft ACI Confidential Containers.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-21522?

CVE-2026-21522 is a medium-severity command injection vulnerability in Microsoft ACI Confidential Containers, published on 10 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.

Weakness: CWE-77

Which versions are affected by CVE-2026-21522?

It affects 1 product.

Products include Microsoft Confcom.

How do I fix CVE-2026-21522?

No fix has been published for CVE-2026-21522 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2026-21522 being exploited?

There is no known exploitation of CVE-2026-21522 in the wild and no public exploit code.

CVE-2024-21400 Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability Critical 9.0

Sources

Also known as GHSA-2628-hv78-qx7g.