Loading story…
SentinelLabs disclosed multiple critical vulnerabilities in Microsoft Azure Defender for IoT that affected both cloud-connected and on-premises deployments and could allow attackers to compromise appliances without authentication. The issues included weaknesses in the password recovery workflow, such as a time-of-check/time-of-use race condition and logic flaws in certificate and subscription validation, tracked in part as CVE-2021-42310, which could let an attacker reset privileged passwords and take over administrative accounts.
The report also detailed a command injection flaw that could lead to root remote code execution after account takeover (CVE-2021-42312), unauthenticated SQL injection bugs in token-related endpoints that could expose session IDs and enable further compromise (CVE-2021-42313 and CVE-2021-42311), and a heap-based buffer overflow in the RCDCAP traffic-processing component (CVE-2021-37222). Microsoft issued security updates and advisories after responsible disclosure, and SentinelLabs said it had not observed active exploitation in the wild at the time of publication.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft issued security updates and advisories in December 2021 to address the reported Azure Defender for IoT vulnerabilities affecting cloud-connected and on-premises deployments. The fixes covered flaws including unauthorized password reset, command injection, SQL injection, and a buffer overflow.
SentinelLabs discovered multiple critical vulnerabilities in Microsoft Azure Defender for IoT and proactively disclosed them to Microsoft. The issues were later tracked as CVE-2021-42310, CVE-2021-42312, CVE-2021-37222, CVE-2021-42313, and CVE-2021-42311.
SentinelLabs published technical details on multiple critical Azure Defender for IoT flaws, including password recovery logic issues, command injection, unauthenticated SQL injection, and a heap-based buffer overflow. At the time of publication, SentinelLabs said it had not observed in-the-wild exploitation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has published multiple Security Update Guide entries for elevation-of-privilege vulnerabilities affecting cloud services including **Azure Resource Manager**, **Azure Entra ID**, **Azure AI Foundry**, and **Redis Enterprise**. The disclosed issues include `CVE-2026-47280` and `CVE-2026-24304` in Azure Resource Manager, `CVE-2026-24305` and `CVE-2025-55241` in Azure Entra ID, `CVE-2025-59271` in Redis Enterprise, and `CVE-2026-35435` in Azure AI Foundry, indicating a broader set of privilege-boundary weaknesses across Microsoft-managed platforms. Microsoft provided the most detail for **CVE-2026-35435**, describing it as a **critical** improper access control flaw in Azure AI Foundry M365 published agents that could be exploited remotely over the network without privileges or user interaction, with potential for high confidentiality impact. The company said exploitation was considered more likely, but the vulnerability had not been publicly disclosed or exploited at publication time, and the service-side issue was already fully mitigated with **no customer action required**; the remaining CVEs were listed with limited public detail in the update guide.
Jun 29, 2026
Microsoft published multiple security advisories covering **information disclosure** issues across Azure services, Windows components, and Power Automate Desktop. The disclosures include `CVE-2026-23661`, `CVE-2026-23662`, and `CVE-2026-23664` affecting **Azure IoT Explorer**; `CVE-2026-21524` affecting **Azure Data Explorer**; `CVE-2026-25186` affecting **Windows Accessibility Infrastructure (`ATBroker.exe`)**; and an earlier advisory, `CVE-2023-35625`, affecting **Azure Machine Learning Compute Instance for SDK Users**. Microsoft also listed `CVE-2026-26121` as a **spoofing** vulnerability in Azure IoT Explorer, indicating that the Azure IoT Explorer issues extend beyond data exposure alone. The most detailed advisory, **`CVE-2026-40374`**, describes an **Important** information disclosure flaw in **Microsoft Power Automate Desktop** with a **CVSS 3.1 score of 6.5**. Microsoft said a logging issue could cause values stored in variables marked as **Sensitive** to appear in execution logs uploaded to the Power Automate portal, where they may be visible to users with **Owner, Co-Owner, or Runner** permissions for the affected desktop flow. The company assessed exploitation as **less likely**, said the issue was **not publicly disclosed or exploited** at publication, and stated that an official fix is available.
Jun 29, 2026
Microsoft disclosed and patched multiple elevation-of-privilege vulnerabilities affecting Azure agent components, including **Azure Monitor Agent**, the **Azure Monitor Agent Metrics Extension**, the **Azure Connected Machine Agent**, and the **Azure Network Watcher VM Extension**. The newly detailed issues include `CVE-2026-32204`, an **Important** flaw in Azure Monitor Agent caused by external control of file name or path (`CWE-73`), and `CVE-2026-42830`, an **Important** untrusted search path vulnerability (`CWE-426`) in the Metrics Extension. Microsoft said both flaws could be exploited locally by low-privileged attackers to gain elevated privileges, with `CVE-2026-32204` potentially enabling file writes and unauthorized code execution as **root**, while `CVE-2026-42830` could lead to privilege escalation and arbitrary code execution through implicit loading behavior tied to OpenSSL configuration handling. The disclosures add to a broader pattern of privilege-escalation fixes across Azure management tooling, following earlier advisories for `CVE-2024-35254` in Azure Monitor Agent, `CVE-2023-35624` in Azure Connected Machine Agent, and `CVE-2025-21188` in the Azure Network Watcher VM Extension. Microsoft assigned a CVSS 3.1 score of **7.8** to `CVE-2026-32204` and **6.5** to `CVE-2026-42830`, said neither issue was publicly disclosed or exploited at the time of publication, and released official fixes. Microsoft credited **Cristhian Parrot of Kroll** for reporting `CVE-2026-42830` through coordinated vulnerability disclosure.
Jun 29, 2026