Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to RCE

CRITICAL 9.8CVE-2026-21531 · GHSA-436v-jg82-p533 · PYSEC-2026-289 · Published 10/02/2026 · updated 17/06/2026

In short

CVE-2026-21531 is a CRITICAL (CVSS 9.8) vulnerability affecting azure-ai-language-conversations-authoring, azure conversation authoring client library (microsoft).
Chance of exploitation in the next 30 days (EPSS): 2.6%, higher than 85.2% of all vulnerabilities.
Fix: update to 1.0.0b4 or later.

Package	Affected versions	Patched versions
azure-ai-language-conversations-authoring PyPI	`< 1.0.0b4`	`1.0.0b4`
azure conversation authoring client library microsoft	`= 1.0.0`	No fix yet

Description

Deserialization of untrusted data in the Azure AI Language Conversations Authoring client library for Python allows an unauthorized attacker to execute code over a network.

NVD description

Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.

References

nvd.nist.gov/vuln/detail/CVE-2026-21531 · ADVISORY
Azure/azure-sdk-for-python · PACKAGE
pypa/advisory-database · WEB
msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21531 · WEB
pypi.org/project/azure-ai-language-conversations-authoring · WEB
GitHub Advisory GHSA-436v-jg82-p533 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free