---
id: CVE-2026-21531
aliases:
  - GHSA-436v-jg82-p533
  - PYSEC-2026-289
title: >-
  Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to
  RCE
summary: >-
  Azure AI Language Authoring Elevation of Privilege Vulnerability can Lead to
  RCE
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
vendor: azure-ai-language-conversations-authoring
product: azure-ai-language-conversations-authoring
ecosystem: pip
affected:
  - azure-ai-language-conversations-authoring < 1.0.0b4
patched:
  - azure-ai-language-conversations-authoring 1.0.0b4
published: '2026-02-10'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T15:30:04.364585856Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-436v-jg82-p533'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-21531'
  - url: 'https://github.com/Azure/azure-sdk-for-python'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/azure-ai-language-conversations-authoring/PYSEC-2026-289.yaml
  - url: 'https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21531'
  - url: 'https://pypi.org/project/azure-ai-language-conversations-authoring'
  - url: 'https://github.com/advisories/GHSA-436v-jg82-p533'
tags:
  - osv
  - pip
  - exploit-available
  - ghsa
epss: 0.0258
epssPercentile: 0.85265
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/NetVanguard-cmd/CVE-2026-21531'
  checkedAt: '2026-11-05T15:38:06.015Z'
exploitAvailable: true
cwe:
  - CWE-502
ingestedAt: '2026-10-27T16:11:58.724Z'
---

## Overview

Deserialization of untrusted data in the Azure AI Language Conversations Authoring client library for Python allows an unauthorized attacker to execute code over a network.

## Affected packages

- `azure-ai-language-conversations-authoring < 1.0.0b4`

## Remediation

Upgrade to a patched release:

- `azure-ai-language-conversations-authoring 1.0.0b4`