CVE-2026-69555

Azure Arc Elevation of Privilege Vulnerability

Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Arc

CVE-2026-70009

Azure Arc Elevation of Privilege Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Arc

CVE-2025-49707

Azure Virtual Machines Spoofing Vulnerability

Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Dcadsv5 Series Azure Vm Dcasv5 Series Azure Vm Dcedsv5 Series Azure Vm and 30 more

CVE-2025-47995

Azure Machine Learning Elevation of Privilege Vulnerability

Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Machine Learning

CVE-2026-88094

Azure Storage Library Elevation of Privilege Vulnerability

Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure-storage-blob-batch Edge Chromium

CVE-2026-69399

Azure Arc Elevation of Privilege Vulnerability

Unintended proxy or intermediary in Azure Arc allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Arc

CVE-2026-108456

Azure AI Foundry Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Ai Foundry

CVE-2026-83938

Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability

Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Kubernetes Configuration Service Azure Kubernetes Service

CVE-2026-105014

Azure Pipelines Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Pipelines

CVE-2026-50516

Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Kubernetes Service

CVE-2026-69877

Azure DevOps Information Disclosure Vulnerability

Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Cli Azure Command-line Interface Azure Devops Cli Extension

CVE-2026-85922

Azure Key Vault Security Feature Bypass Vulnerability

Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure-keyvault-administration Azure-keyvault-certificates Azure-keyvault-keys and 10 more

CVE-2026-85925

Azure Key Vault Client SDK Elevation of Privilege Vulnerability

Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure-keyvault-administration Azure-keyvault-certificates Azure-keyvault-keys and 5 more

CVE-2026-88132

Azure Key Vault Information Disclosure Vulnerability

Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Keyvault Administration Azure Keyvault Certificates Azure Keyvault Keys and 1 more

CVE-2026-69435

Azure SRE Agent Elevation of Privilege Vulnerability

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Sre Agent

CVE-2026-83947

Azure Event Grid Spoofing Vulnerability

Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Event Grid Azure Event Grid System

CVE-2026-83711

Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability

Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Active Directory B2c Entra Id

CVE-2026-70352

Azure AI Language Elevation of Privilege Vulnerability

Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Ai Language Authoring

CVE-2026-100207

Azure CycleCloud Remote Code Execution Vulnerability

Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Cyclecloud

CVE-2026-85891

Azure HDInsight Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Hdinsights