Loading story…
Microsoft deployed server-side fixes for 18 vulnerabilities affecting Azure cloud services and Copilot-branded AI products, including Azure Billing, Microsoft Fabric, Container Registry, Logic Apps, AI Foundry, Azure Arc, Azure Database for PostgreSQL, Cosmos DB, Dataverse, and Microsoft 365 Copilot. A reported subset of 12 network-accessible flaws includes authentication and authorization bypasses, missing-authentication defects, path traversal, command injection, and other injection vulnerabilities; seven were assigned CVSS 10.0 scores. Additional issues include information-disclosure vulnerabilities in Copilot and Azure Machine Learning and a spoofing flaw in Azure Portal.
Microsoft rated the cloud and AI issues as critical, although individual published severity scores range from medium to critical. No active exploitation or CISA Known Exploited Vulnerabilities listings had been reported. The affected Azure and AI services were remediated by Microsoft, requiring no customer patching, but organizations should validate service status, review privileged identities, integrations, and container-registry activity for anomalies. Separately, Windows users must install updates for the elevation-of-privilege vulnerability CVE-2026-85921.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft also released a patch for the separate Windows elevation-of-privilege vulnerability CVE-2026-85921. Users must update Windows to remediate the flaw; Microsoft assessed exploitation as less likely.
Microsoft released server-side fixes for 18 vulnerabilities across Azure services and Copilot-branded AI products, including elevation-of-privilege, information-disclosure, and Azure Portal spoofing issues. Microsoft said none had been flagged as exploited and customers did not need to take action for the server-side fixes.
Microsoft disclosed 12 network-based privilege-escalation vulnerabilities affecting 10 managed Azure and Microsoft 365 services. The cluster included seven CVSS 10.0 flaws; no public exploitation or CISA KEV listings were reported.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed a set of security flaws affecting cloud and AI services, including **Microsoft 365 Copilot**, **Microsoft Copilot**, **Microsoft 365 Copilot BizChat**, **Azure DevOps**, **Azure Cloud Shell**, **Azure Data Factory**, **Microsoft Bing**, and **Microsoft Bing Images**. The issues span **information disclosure**, **elevation of privilege**, **tampering**, and **remote code execution**, with published identifiers including `CVE-2026-24299`, `CVE-2026-26136`, `CVE-2026-26137`, `CVE-2026-23658`, `CVE-2026-32169`, `CVE-2026-23659`, `CVE-2026-26120`, and `CVE-2026-32191`. Germany's dCERT separately highlighted multiple vulnerabilities in **Microsoft 365 Copilot**, underscoring enterprise concern around AI-assisted productivity platforms. The most severe issue in the group is **`CVE-2026-32191`**, a **critical remote code execution** flaw in **Microsoft Bing Images**. Public reporting tied the bug to **OS command injection** caused by improper neutralization of special elements in a command, potentially allowing an unauthenticated attacker to execute code over a network. Additional Bing exposure was tracked as **`CVE-2026-26120`**, a tampering vulnerability, while the Copilot-related flaws included both **information disclosure** and **privilege escalation**, indicating risk to data confidentiality and tenant-level access boundaries across Microsoft's hosted services.
Jul 24, 2026
Microsoft released fixes for **137 vulnerabilities** across Windows, Azure, Microsoft 365, developer tools, and AI-related products, with no zero-days reported as exploited in the wild. The most urgent issues included a **wormable pre-auth remote code execution** flaw in **Windows Netlogon** (`CVE-2026-41089`), an **unauthenticated RCE** in the **Windows DNS Client** (`CVE-2026-41096`) that can be triggered through crafted DNS responses, and a **remote code execution** bug in **Microsoft Dynamics 365 on-premises** (`CVE-2026-42898`). Microsoft also patched an authenticated **SharePoint Server RCE** (`CVE-2026-40365`), multiple Microsoft Word Preview Pane RCEs, and a critical authentication bypass in the Microsoft SSO Plugin for Jira & Confluence (`CVE-2026-41103`). The release was notable for its severity, with reports citing **16 to 30 critical vulnerabilities** depending on classification, and **14 flaws scoring 9.0 or higher**, including an **Azure DevOps information disclosure** issue rated `CVSS 10.0` that Microsoft said had already been fully mitigated. Elevation-of-privilege bugs made up the largest share of fixes, spanning the Windows kernel, Win32k, TCP/IP, SMB Client, Print Spooler, and other core components; two locally exploitable issues, including **Windows Print Spooler** (`CVE-2026-34342`) and **Windows Message Queueing** (`CVE-2026-33838`), were publicly disclosed alongside patches. Microsoft said its AI-driven bug-finding system **MDASH** identified 16 of the vulnerabilities, and it separately warned enterprises to complete **Secure Boot certificate** updates before June 26, 2026, while noting a BitLocker Recovery issue on some Windows Server 2025 systems with an unrecommended Group Policy setting.
Jun 29, 2026
Microsoft released security updates for 90 vulnerabilities across its product portfolio, including 24 remote code execution flaws and nine rated **critical**. The August patch bundle addressed severe issues in Microsoft Dynamics 365, Microsoft Copilot Studio, Azure Health Bot, Windows TCP/IP, Windows Reliable Multicast Transport Driver, Windows Network Virtualization, and Linux boot components **`grub2`** and **`shim`**. Microsoft and CSIRT.SK said six vulnerabilities were already being exploited in the wild: **`CVE-2024-38189`**, **`CVE-2024-38178`**, **`CVE-2024-38193`**, **`CVE-2024-38106`**, **`CVE-2024-38107`**, and **`CVE-2024-38213`**. Among the most serious patched bugs were **`CVE-2024-38063`**, which allows unauthenticated remote code execution in Windows TCP/IP via crafted IPv6 packets, and **`CVE-2024-38140`**, which enables unauthenticated remote code execution in the Windows Reliable Multicast Transport Driver when PGM is enabled; defenders were urged to deploy the updates immediately.
Jul 24, 2026