Microsoft Discloses Elevation-of-Privilege Flaws Across Azure Services

Microsoft has published multiple Security Update Guide entries for elevation-of-privilege vulnerabilities affecting cloud services including Azure Resource Manager, Azure Entra ID, Azure AI Foundry, and Redis Enterprise. The disclosed issues include CVE-2026-47280 and CVE-2026-24304 in Azure Resource Manager, CVE-2026-24305 and CVE-2025-55241 in Azure Entra ID, CVE-2025-59271 in Redis Enterprise, and CVE-2026-35435 in Azure AI Foundry, indicating a broader set of privilege-boundary weaknesses across Microsoft-managed platforms.

Microsoft provided the most detail for CVE-2026-35435, describing it as a critical improper access control flaw in Azure AI Foundry M365 published agents that could be exploited remotely over the network without privileges or user interaction, with potential for high confidentiality impact. The company said exploitation was considered more likely, but the vulnerability had not been publicly disclosed or exploited at publication time, and the service-side issue was already fully mitigated with no customer action required; the remaining CVEs were listed with limited public detail in the update guide.