{"schema":"threatline.record/2","record":{"id":"CVE-2026-21531","aliases":["GHSA-436v-jg82-p533","PYSEC-2026-289"],"summary":"Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE","details":"Deserialization of untrusted data in the Azure AI Language Conversations Authoring client library for Python allows an unauthorized attacker to execute code over a network.","categories":["Containers & cloud"],"product":"azure-ai-language-conversations-authoring","vendor":"Microsoft","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-436v-jg82-p533","source_modified_at":"2026-10-27T15:21:49Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"pip","name":"azure-ai-language-conversations-authoring"},"range":"< 1.0.0b4"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-21531","source_modified_at":"2026-08-19T16:26:02.015Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"Azure AI Language Authoring","vendor":"Microsoft","versions":[{"version":"1.0.0","lessThan":"1.0.0b4","versionType":"custom","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-436v-jg82-p533","source_modified_at":"2026-10-27T15:30:04.364585856Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"azure-ai-language-conversations-authoring","ecosystem":"PyPI","purl":"pkg:pypi/azure-ai-language-conversations-authoring"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0b4"}]}],"versions":["1.0.0b1","1.0.0b2","1.0.0b3"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-436v-jg82-p533","source_modified_at":"2026-10-27T15:21:49Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"ecosystem":"pip","name":"azure-ai-language-conversations-authoring"},"version":"1.0.0b4"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-21531","source_modified_at":"2026-08-19T16:26:02.015Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"Azure AI Language Authoring","ecosystem":null},"version":"1.0.0b4","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-436v-jg82-p533","source_modified_at":"2026-10-27T15:30:04.364585856Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"azure-ai-language-conversations-authoring","ecosystem":"PyPI","purl":"pkg:pypi/azure-ai-language-conversations-authoring"},"version":"1.0.0b4"}],"cvss":9.8,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.0258,"percentile":0.85137,"score_date":"2026-10-27"},"published_at":"2026-02-10T17:51:31.660Z","modified_at":"2026-10-27T15:30:04.364585856Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-436v-jg82-p533","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T15:21:49Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-21531","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-08-19T16:26:02.015Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-436v-jg82-p533","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T15:30:04.364585856Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21531","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21531","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21531","tags":["vendor-advisory","patch"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/azure-ai-language-conversations-authoring/PYSEC-2026-289.yaml","source":"GitHub Advisory Database"},{"url":"https://pypi.org/project/azure-ai-language-conversations-authoring","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-436v-jg82-p533","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"total","assessed_at":"2026-02-11T04:56:07.295834Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-27T15:30:04.364585856Z","content_hash":"a643994a52a2ac5b3e5ba5fbad183aef857e8c08e964eb93285d980b9364148c"}}