Microsoft Fixes Critical Azure, Microsoft 365 and Copilot Privilege Escalation Flaws

Microsoft deployed server-side fixes for 18 vulnerabilities affecting Azure cloud services and Copilot-branded AI products, including Azure Billing, Microsoft Fabric, Container Registry, Logic Apps, AI Foundry, Azure Arc, Azure Database for PostgreSQL, Cosmos DB, Dataverse, and Microsoft 365 Copilot. A reported subset of 12 network-accessible flaws includes authentication and authorization bypasses, missing-authentication defects, path traversal, command injection, and other injection vulnerabilities; seven were assigned CVSS 10.0 scores. Additional issues include information-disclosure vulnerabilities in Copilot and Azure Machine Learning and a spoofing flaw in Azure Portal.

Microsoft rated the cloud and AI issues as critical, although individual published severity scores range from medium to critical. No active exploitation or CISA Known Exploited Vulnerabilities listings had been reported. The affected Azure and AI services were remediated by Microsoft, requiring no customer patching, but organizations should validate service status, review privileged identities, integrations, and container-registry activity for anomalies. Separately, Windows users must install updates for the elevation-of-privilege vulnerability CVE-2026-85921.