high7.5
CVE-2026-21226
Azure Core is vulnerable to deserialization of untrusted data
Impact
Deserialization of untrusted data in Azure Core shared client library for Python allows an authorized attacker to execute code over a network.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | azure-core | < 1.38.0 | 1.38.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Azure Core Shared Client Library | from 1.1.0 before 1.38.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21226
- https://github.com/advisories/GHSA-jm66-cg57-jjv5
- https://nvd.nist.gov/vuln/detail/CVE-2026-21226
- https://github.com/Azure/azure-sdk-for-python/blob/6d2e6431ea0991861640e449e51e894247a7771a/sdk/core/azure-core/CHANGELOG.md#1380-2026-01-12