Loading story…
Federal reviewers approved Microsoft GCC High for handling sensitive government data despite internal findings that the company’s security documentation was inadequate and that evaluators lacked confidence in the service’s overall security posture. ProPublica reported that a late-2024 internal government review described Microsoft’s submission in scathing terms and raised concerns that officials could not fully verify how sensitive data was protected as it moved through the cloud environment. The reporting also highlighted a structural FedRAMP weakness: third-party assessors that help validate cloud services are selected and paid by the vendors they evaluate, creating concerns about independence and rigor.
Additional reporting said the consequences are now surfacing across government, including at the Justice Department, where officials learned that Microsoft had used China-based engineers to help service sensitive cloud systems despite restrictions on non-U.S. citizens assisting with certain IT maintenance. According to the reports, that arrangement was not disclosed in the written security plan submitted for GCC High, and officials said they learned of it through investigative reporting rather than from Microsoft or FedRAMP. Microsoft said it had communicated the information to Justice officials before 2020 and has since ended the use of China-based engineers in government systems, but the episode intensified concerns that other risks in GCC High and the broader FedRAMP authorization process may have gone undetected.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
ProPublica published an investigation detailing how FedRAMP approved GCC High despite longstanding internal concerns, structural weaknesses in the authorization process, and Microsoft's prior security controversies involving government systems.
The Justice Department recently stepped up scrutiny of cybersecurity misrepresentations by federal contractors, a broader development highlighted in connection with concerns around Microsoft's government cloud representations. The references do not provide a more specific date for this shift.
In December 2024, FedRAMP approved Microsoft Government Community Cloud High even though internal reviewers said Microsoft had not provided sufficient detailed security documentation and evaluators lacked confidence in judging the product's overall security posture.
While the FedRAMP review remained unresolved, GCC High continued to be adopted across federal agencies and the defense sector. Its growing deployment increased pressure to approve the service because it was already widely in use.
FedRAMP reviewers began flagging problems with Microsoft Government Community Cloud High as early as 2020, including missing documentation on data flows and encryption. Repeated exchanges with Microsoft, third-party assessors, and the Justice Department did not fully resolve the issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
schneier.com
Open sourcepropublica.org
Open sourcetechdirt.com
Open sourceboingboing.net
Open sourcearstechnica.com
Open sourcepropublica.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has published multiple Security Update Guide entries for elevation-of-privilege vulnerabilities affecting cloud services including **Azure Resource Manager**, **Azure Entra ID**, **Azure AI Foundry**, and **Redis Enterprise**. The disclosed issues include `CVE-2026-47280` and `CVE-2026-24304` in Azure Resource Manager, `CVE-2026-24305` and `CVE-2025-55241` in Azure Entra ID, `CVE-2025-59271` in Redis Enterprise, and `CVE-2026-35435` in Azure AI Foundry, indicating a broader set of privilege-boundary weaknesses across Microsoft-managed platforms. Microsoft provided the most detail for **CVE-2026-35435**, describing it as a **critical** improper access control flaw in Azure AI Foundry M365 published agents that could be exploited remotely over the network without privileges or user interaction, with potential for high confidentiality impact. The company said exploitation was considered more likely, but the vulnerability had not been publicly disclosed or exploited at publication time, and the service-side issue was already fully mitigated with **no customer action required**; the remaining CVEs were listed with limited public detail in the update guide.
Jun 29, 2026
Microsoft published three high-severity cloud-service vulnerabilities affecting **Microsoft Purview eDiscovery**, **Microsoft Entra ID Entitlement Management**, and **Microsoft Dynamics 365 Online**. The flaws are tracked as `CVE-2026-26150`, `CVE-2026-35431`, and `CVE-2026-32210`, and all are classified as **server-side request forgery (SSRF)** under `CWE-918`. Microsoft tagged each issue as affecting an **exclusively hosted service**, indicating exposure in Microsoft-managed online environments rather than on-premises deployments. According to the CVE records, `CVE-2026-26150` could let an unauthorized attacker elevate privileges over a network in Purview eDiscovery, while `CVE-2026-35431` and `CVE-2026-32210` could enable spoofing in Entra ID Entitlement Management and Dynamics 365 Online. The published `CVSS v3.1` vectors show low attack complexity and no required privileges across all three issues, with Entra ID carrying the broadest potential impact to confidentiality, integrity, and availability, and Dynamics 365 requiring user interaction. Microsoft linked the disclosures to its Security Response Center guidance for customer tracking and remediation.
Jun 29, 2026
Microsoft is contending with a sharp rise in software vulnerabilities uncovered by Anthropic’s AI model **Mythos** under **Project Glasswing**, according to internal materials reviewed by ProPublica. The report says the model was identifying flaws faster than Microsoft could remediate them, including **90 critical** and **141 important** SharePoint bugs found in April alone, with additional issues discovered in early May. Microsoft reportedly prioritized critical and important findings, while security experts warned that lower-severity flaws can still be chained into serious attack paths, reducing the usefulness of traditional severity-based triage. The pressure from AI-assisted bug discovery is reflected in Microsoft’s unusually heavy June security updates, which included dozens of fixes across Windows, Microsoft 365, Azure, Office, Exchange, SharePoint, and developer tools. Among the most urgent issues was **CVE-2026-41091**, a Microsoft Defender elevation-of-privilege flaw that was **publicly disclosed and exploited in the wild**, alongside multiple critical remote-code-execution vulnerabilities such as **CVE-2026-48567** in Azure HorizonDB and **CVE-2026-47291** in `HTTP.sys`. The disclosures highlight growing concern that defenders may have only a limited lead before attackers gain comparable AI-driven vulnerability discovery capabilities.
Sep 3, 2026