Microsoft Addresses High-Severity Flaws in Azure DevOps, Graph, Azure OpenAI and Windows

Microsoft’s November security disclosures address vulnerabilities enabling remote code execution and privilege escalation across development infrastructure, cloud services and Windows. Azure DevOps Server vulnerability CVE-2026-109467 (CVSS 9.9) allows an attacker with Project Reader access to trigger unauthorized pipeline execution and run code on pipeline agents without additional user interaction. Microsoft Graph vulnerability CVE-2026-114162 (CVSS 9.1) allows an attacker controlling an application with the affected role-removal permission to assign privileged directory roles, potentially gaining Global Administrator access. A Rapid7 overview lists 20 high-scoring vulnerabilities—15 remote code execution and five privilege escalation flaws—including a SharePoint Server issue scored 9.9; those figures describe the excerpt, not necessarily the complete release.

Microsoft also disclosed CVE-2026-96067 (CVSS 9.8), an integer overflow in Windows Color Management that permits unauthenticated remote code execution when an application processes a specially crafted color profile. Official fixes are available for the Azure DevOps, Graph and Color Management vulnerabilities; Microsoft reported no exploitation or prior public disclosure for these three flaws at publication. Separately, Microsoft fully mitigated CVE-2026-119990 (CVSS 9.8), a critical Azure OpenAI privilege escalation flaw involving missing authentication, and said customers need take no action. Defenders should prioritize applicable Azure DevOps and Windows updates, verify Graph remediation guidance, and review application permissions capable of granting privileged directory roles.