Microsoft Addresses Elevation of Privilege Flaws Across Azure and Account Services
Vulnerability Disclosure · 5 sources · Updated 3mo ago · First seen May 25, 2026
Microsoft has published security advisories for multiple elevation of privilege vulnerabilities affecting cloud and identity-related products, including Payment Orchestrator Service (CVE-2026-26125), Microsoft Account (CVE-2025-21396), Azure Bot Service (CVE-2025-55244), Azure PolicyWatch (CVE-2024-49052), and Azure CycleCloud (CVE-2022-41085). The issues were disclosed through the Microsoft Security Response Center and span both Azure platform components and Microsoft-managed account services.
The advisories provide limited public technical detail, but the affected products indicate potential risk to organizations relying on Microsoft cloud workloads, automation, policy management, bot integrations, and identity services. Security teams should review the relevant MSRC entries, determine whether exposed services are in use, and prioritize remediation for any impacted environments where privilege escalation could increase access to sensitive resources or administrative functions.
