CVE-2026-40379

Azure Entra ID Spoofing Vulnerability

Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Enterprise Security Token Service Entra Id Microsoft Entra Id

CVE-2026-41086

Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability

Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Portal Windows Admin Center Windows Admin Center

CVE-2026-41105

Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Monitor Action Group Notification System

CVE-2026-42830

Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability

Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Monitor Agent Azure Monitor Agent Metrics Extension

CVE-2026-42823

Azure Logic Apps Elevation of Privilege Vulnerability

Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Logic Apps

CVE-2026-33833

Azure Machine Learning Notebook Spoofing Vulnerability

Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Machine Learning

CVE-2026-32204

Azure Monitor Agent Elevation of Privilege Vulnerability

External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Monitor Azure Monitor Agent

CVE-2026-40381

Azure Connected Machine Agent Elevation of Privilege Vulnerability

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Connected Machine Agent

CVE-2026-35435

Azure AI Foundry Elevation of Privilege Vulnerability

Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.6 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

Azure Ai Foundry

CVE-2026-35428

Azure Cloud Shell Spoofing Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Cloud Shell

CVE-2026-32207

Azure Machine Learning Notebook Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Machine Learning

CVE-2026-42826

Azure DevOps Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Devops

CVE-2026-33109

Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Managed Instance For Apache Cassandra

CVE-2026-32171

Azure Logic Apps Elevation of Privilege Vulnerability

Insufficiently protected credentials in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Logic Apps

CVE-2026-21515

Azure IoT Central Elevation of Privilege Vulnerability

Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Iot Central

CVE-2026-32173

Azure SRE Agent Information Disclosure Vulnerability

Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Sre Agent Azure Sre Agent Gateway Azure Sre Agent Gateway Signalr Hub

CVE-2026-32192

Azure Monitor Agent Elevation of Privilege Vulnerability

Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed

Vendors

Microsoft

Products

Azure Monitor Azure Monitor Agent

CVE-2026-32168

Azure Monitor Agent Elevation of Privilege Vulnerability

Improper input validation in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Monitor Azure Monitor Agent

CVE-2025-64663

Custom Question Answering Elevation of Privilege Vulnerability

Custom Question Answering Elevation of Privilege Vulnerability

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Cognitive Service For Language Azure Language

CVE-2025-62550

Azure Monitor Agent Remote Code Execution Vulnerability

Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Azure Monitor Agent