Loading story…
Microsoft disclosed and patched two Azure Logic Apps Elevation of Privilege vulnerabilities, tracked as CVE-2026-42823 and CVE-2026-32171, through its Security Update Guide. Both advisories identify privilege-escalation issues affecting the Azure Logic Apps service, expanding the list of cloud platform flaws that could allow an attacker to gain higher permissions within impacted environments.
The vulnerabilities were published in separate Microsoft advisories, with CVE-2026-32171 appearing first and CVE-2026-42823 added later. Microsoft provided the notices via MSRC update entries rather than detailed public write-ups, indicating customers should review the Security Update Guide and apply the relevant Azure-side remediations or service updates associated with their Logic Apps deployments.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft added CVE-2026-42823, another Azure Logic Apps Elevation of Privilege vulnerability, to its Security Update Guide. The reference indicates the advisory was published on 2026-05-12.
Microsoft added CVE-2026-32171, an Azure Logic Apps Elevation of Privilege vulnerability, to its Security Update Guide. The reference indicates the advisory was published on 2026-04-14.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
msrc.microsoft.com
Open sourcemsrc.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed and patched multiple elevation-of-privilege vulnerabilities affecting Azure agent components, including **Azure Monitor Agent**, the **Azure Monitor Agent Metrics Extension**, the **Azure Connected Machine Agent**, and the **Azure Network Watcher VM Extension**. The newly detailed issues include `CVE-2026-32204`, an **Important** flaw in Azure Monitor Agent caused by external control of file name or path (`CWE-73`), and `CVE-2026-42830`, an **Important** untrusted search path vulnerability (`CWE-426`) in the Metrics Extension. Microsoft said both flaws could be exploited locally by low-privileged attackers to gain elevated privileges, with `CVE-2026-32204` potentially enabling file writes and unauthorized code execution as **root**, while `CVE-2026-42830` could lead to privilege escalation and arbitrary code execution through implicit loading behavior tied to OpenSSL configuration handling. The disclosures add to a broader pattern of privilege-escalation fixes across Azure management tooling, following earlier advisories for `CVE-2024-35254` in Azure Monitor Agent, `CVE-2023-35624` in Azure Connected Machine Agent, and `CVE-2025-21188` in the Azure Network Watcher VM Extension. Microsoft assigned a CVSS 3.1 score of **7.8** to `CVE-2026-32204` and **6.5** to `CVE-2026-42830`, said neither issue was publicly disclosed or exploited at the time of publication, and released official fixes. Microsoft credited **Cristhian Parrot of Kroll** for reporting `CVE-2026-42830` through coordinated vulnerability disclosure.
Jun 29, 2026
Microsoft has published multiple Security Update Guide entries for elevation-of-privilege vulnerabilities affecting cloud services including **Azure Resource Manager**, **Azure Entra ID**, **Azure AI Foundry**, and **Redis Enterprise**. The disclosed issues include `CVE-2026-47280` and `CVE-2026-24304` in Azure Resource Manager, `CVE-2026-24305` and `CVE-2025-55241` in Azure Entra ID, `CVE-2025-59271` in Redis Enterprise, and `CVE-2026-35435` in Azure AI Foundry, indicating a broader set of privilege-boundary weaknesses across Microsoft-managed platforms. Microsoft provided the most detail for **CVE-2026-35435**, describing it as a **critical** improper access control flaw in Azure AI Foundry M365 published agents that could be exploited remotely over the network without privileges or user interaction, with potential for high confidentiality impact. The company said exploitation was considered more likely, but the vulnerability had not been publicly disclosed or exploited at publication time, and the service-side issue was already fully mitigated with **no customer action required**; the remaining CVEs were listed with limited public detail in the update guide.
Jun 29, 2026
Microsoft published security advisories for two **Elevation of Privilege** flaws affecting Windows components: `CVE-2026-23660` in **Windows Admin Center in Azure Portal** and `CVE-2025-62472` in **Windows Remote Access Connection Manager**. Both entries were released through Microsoft's Security Update Guide, identifying separate privilege-escalation issues in enterprise-relevant Windows management and connectivity functionality. The disclosures indicate that attackers who successfully exploit the vulnerabilities could gain higher privileges on affected systems, increasing the risk of broader compromise after initial access. Organizations using Windows administrative tooling in Azure environments and systems relying on Remote Access Connection Manager should review Microsoft's advisories, determine exposure to the affected components, and prioritize applicable security updates and mitigation steps.
Jul 12, 2026