Microsoft Azure Hdinsight vulnerabilities

11 CVEs affecting Microsoft Azure Hdinsight, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-85891, published 2026-10-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-23408, published 2023-03-14. Medium severity, CVSS 4.5. EPSS: 4% chance of exploitation in the next 30 days. Azure Apache Ambari Spoofing Vulnerability
• CVE-2023-38156, published 2023-09-12. High severity, CVSS 7.2. EPSS: 2% chance of exploitation in the next 30 days. Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege Vulnerability
• CVE-2023-36419, published 2023-10-10. Critical severity, CVSS 9.8. EPSS: 1.8% chance of exploitation in the next 30 days. Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability
• CVE-2023-35393, published 2023-08-08. Medium severity, CVSS 4.5. EPSS: 1.4% chance of exploitation in the next 30 days. Azure Apache Hive Spoofing Vulnerability
• CVE-2023-36881, published 2023-08-08. Medium severity, CVSS 4.5. EPSS: 1% chance of exploitation in the next 30 days. Azure Apache Ambari Spoofing Vulnerability
• CVE-2023-36877, published 2023-08-08. Medium severity, CVSS 4.5. EPSS: 1% chance of exploitation in the next 30 days. Azure Apache Oozie Spoofing Vulnerability
• CVE-2023-38188, published 2023-08-08. Medium severity, CVSS 4.5. EPSS: 1% chance of exploitation in the next 30 days. Azure Apache Hadoop Spoofing Vulnerability
• CVE-2026-81349, published 2026-09-08. High severity, CVSS 7.2. EPSS: 1% chance of exploitation in the next 30 days. Improper neutralization of special elements used in an os command ('os command injection') in Azure HDInsights allows an authorized attacker to elevate privileges over a network.
• CVE-2023-35394, published 2023-08-08. Medium severity, CVSS 4.6. EPSS: 1% chance of exploitation in the next 30 days. Azure HDInsight Jupyter Notebook Spoofing Vulnerability
• CVE-2026-85891, published 2026-10-13. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.

Latest

• CVE-2026-21529, published 2026-02-10. Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days. Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an authorized attacker to perform spoofing over a network.