CVE-2026-21226 Azure Core shared client library for Python Remote Code Execution Vulnerability

🗓️ 13 Jan 2026 18:04:55Reported by microsoftType

Azure Core shared Python client library has a remote code execution vulnerability (CVE-2026-21226).

Reporter	Title	Published	Views	Family All 56
IBM Security Bulletins	Security Bulletin: IBM IBM Edge Data Collector uses azure_core-1.14.0-py2.py3-none-any.whl which is vulnerable to CVE-2026-21226.	27 Feb 202612:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands that use mapping assistance are vulnerable to remote code execution (CVE-2026-21226)	5 Feb 202612:47	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses azure-core 1.37.0 and setuptools 75.8.0 which are vulnerable to CVE-2026-21226 and CVE-2025-47273.	27 May 202616:07	–	ibm
Chainguard	CVE-2026-21226 vulnerabilities	20 Jan 202619:20	–	cgr
Circl	CVE-2026-21226	13 Jan 202618:01	–	circl
CNNVD	Microsoft Azure 代码问题漏洞	13 Jan 202600:00	–	cnnvd
CVE	CVE-2026-21226	13 Jan 202618:04	–	cve
EUVD	EUVD-2026-2009	13 Jan 202618:04	–	euvd
Fedora	[SECURITY] Fedora 43 Update: azure-cli-2.81.0-2.fc43	20 Feb 202600:53	–	fedora
Fedora	[SECURITY] Fedora 43 Update: python-azure-core-1.38.0-2.fc43	20 Feb 202600:53	–	fedora

[
  {
    "vendor": "Microsoft",
    "product": "Azure Core shared client library for Python",
    "versions": [
      {
        "version": "1.1.0",
        "lessThan": "1.38.0",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21226

01 Apr 2026 13:49Current

CVSS 3.17.5

EPSS0.00776

CWE-502