CVE-2022-39327: Microsoft Azure Command-Line Interface

Critical severity, CVSS 9.8. EPSS: 3.5% chance of exploitation in the next 30 days.

Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have been provided by an external source. The vulnerability is only applicable when the Azure CLI command is run on a Windows machine and with any version of PowerShell and when the parameter value contains the `&` or `|` symbols. If any of these prerequisites are not met, this vulnerability is not applicable. Users should upgrade to version 2.40.0 or greater to receive a a mitigation for the vulnerability.

Affected products

• Microsoft Azure Command-Line Interface: before 2.40.0 (fixed in 2.40.0)

Published 2022-10-25. Last modified 2026-06-17.