Azure security advisories
60 threat alerts tracking vulnerabilities and security advisories that affect Azure products.
Vulnios monitors Azure CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent Azure security news in one place, or click into an individual alert for full detail.
CVE-2026-108456 Azure AI Foundry Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-108456CVE-2026-105014 Azure Pipelines Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
criticalCVE-2026-105014CVE-2026-110063 VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-110063CVE-2026-88094 Azure Storage Library Elevation of Privilege Vulnerability
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-88094CVE-2026-100207 Azure CycleCloud Remote Code Execution Vulnerability
Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.
criticalCVE-2026-100207CVE-2026-85922 Azure Key Vault Security Feature Bypass Vulnerability
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
criticalCVE-2026-85922CVE-2026-85925 Azure Key Vault Client SDK Elevation of Privilege Vulnerability
Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-85925CVE-2026-85916 Azure Active Directory Information Disclosure Vulnerability
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.
criticalCVE-2026-85916CVE-2026-96204 Azure Arc Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-96204CVE-2026-88132 Azure Key Vault Information Disclosure Vulnerability
Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.
criticalCVE-2026-88132CVE-2026-69877 Azure DevOps Information Disclosure Vulnerability
Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.
criticalCVE-2026-69877CVE-2026-85891 Azure HDInsight Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.
criticalCVE-2026-85891CVE-2026-69435 Azure SRE Agent Elevation of Privilege Vulnerability
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-69435CVE-2026-77900 Azure App Service Remote Code Execution Vulnerability
Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
criticalCVE-2026-77900CVE-2026-83943 Azure API Center Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network.
criticalCVE-2026-83943CVE-2026-83947 Azure Event Grid Spoofing Vulnerability
Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.
criticalCVE-2026-83947CVE-2026-85917 Azure AI Foundry Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-85917CVE-2026-87701 Azure Cosmos DB Elevation of Privilege Vulnerability
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-87701CVE-2026-62874 Azure Billing Elevation of Privilege Vulnerability
Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-62874CVE-2026-70200 Azure Logic Apps Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-70200CVE-2026-68791 Azure Machine Learning Information Disclosure Vulnerability
Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.
criticalCVE-2026-68791CVE-2026-70009 Azure Arc Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-70009CVE-2026-85878 Azure Database for PostgreSQL Elevation of Privilege Vulnerability
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-85878CVE-2026-85889 Azure AI Foundry Elevation of Privilege Vulnerability
Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-85889CVE-2026-69399 Azure Arc Elevation of Privilege Vulnerability
Microsoft Security Response Center published an advisory on "CVE-2026-69399 Azure Arc Elevation of Privilege Vulnerability". Topic areas: microsoft, windows, azure, patch. Published September 17, 2026
criticalCVE-2026-69399CVE-2026-83944 Azure Logic Apps Elevation of Privilege Vulnerability
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-83944CVE-2026-83946 Azure Portal Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network.
criticalCVE-2026-83946CVE-2026-69854 Spring Cloud Azure Elevation of Privilege Vulnerability
Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-69854CVE-2026-77909 Azure CycleCloud Information Disclosure Vulnerability
Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network.
criticalCVE-2026-77909CVE-2026-81349 Azure HDInsight Ambari Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an os command ('os command injection') in Azure HDInsights allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-81349CVE-2026-62895 Azure Arc SQL Server Extension Elevation of Privilege Vulnerability
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-62895CVE-2026-70352 Azure AI Language Elevation of Privilege Vulnerability
Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-70352CVE-2026-69857 Azure Cosmos DB Spoofing Vulnerability
Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network.
criticalCVE-2026-69857SANS Internet Storm Center Advisory — Sep 1, 2026
SANS Internet Storm Center published an research on "SANS Internet Storm Center Advisory — Sep 1, 2026". Topic areas: sans, isc, incident, daily-summary. Published September 1, 2026. See the original
criticalSANS Internet Storm Center Advisory — Aug 26, 2026
A common thing that folks should "worry" about in Entra (or any platform really) is "who has rights to administer"?  Who can delete or change key things, or modify them
criticalCVE-2026-66800 Azure Data Factory Information Disclosure Vulnerability
Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.
criticalCVE-2026-66800CVE-2026-69555 Azure Arc Elevation of Privilege Vulnerability
Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-69555CVE-2026-68782 Azure SQL Database Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-68782CVE-2026-69519 Azure Stack HCI Information Disclosure Vulnerability
Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.
criticalCVE-2026-69519CVE-2026-69502 Azure SQL Database Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-69502CVE-2026-69543 Azure Virtual Machines Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-69543CVE-2026-68789 Azure SQL Database Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-68789CVE-2026-66309 Azure SQL Database Elevation of Privilege Vulnerability
Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-66309CVE-2026-69400 Azure Logic Apps Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-69400CVE-2026-65816 Azure Arc Elevation of Privilege Vulnerability
Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-65816CVE-2026-62834 Azure Data Factory Elevation of Privilege Vulnerability
Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-62834CVE-2026-69419 Azure Data Manager for Energy Remote Code Execution Vulnerability
Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.
criticalCVE-2026-69419CVE-2026-70340 Azure CycleCloud Elevation of Privilege Vulnerability
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-70340CVE-2026-57104 Azure Storage Explorer Elevation of Privilege Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-57104CVE-2026-65806 Azure CycleCloud Information Disclosure Vulnerability
Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network.
criticalCVE-2026-65806CVE-2026-47299 Azure Monitor Agent Elevation of Privilege Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-47299CVE-2026-62830 Azure SRE Agent Elevation of Privilege Vulnerability
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-62830CVE-2026-68823 Azure Confidential Ledger Remote Code Execution Vulnerability
Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.
criticalCVE-2026-68823CVE-2026-50515 Azure Service Bus Remote Code Execution Vulnerability
Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.
criticalCVE-2026-50515CVE-2026-56162 Azure SQL Database Elevation of Privilege Vulnerability
Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-56162CVE-2026-56161 Azure Logic Apps Information Disclosure Vulnerability
Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.
criticalCVE-2026-56161CVE-2026-62869 Azure Entra ID Spoofing Vulnerability
Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network.
criticalCVE-2026-62869CVE-2026-63522 Azure SQL Database Elevation of Privilege Vulnerability
Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally.
criticalCVE-2026-63522CVE-2026-50481 Azure Active Directory Elevation of Privilege Vulnerability
Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-50481CVE-2026-62836 Azure SQL Managed Instance Elevation of Privilege Vulnerability
Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-62836
Showing the 60 most recent. Older alerts are archived but still reachable via search and the main feed.
Track Azure exposure across your environment
Vulnios automatically cross-references your asset inventory against new Azure CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan