Skip to content
OpenAdvisories
High NCSC-2026-0057 10 CVEs

Kwetsbaarheden verholpen in Microsoft Azure

Published Feb 10, 2026 · Updated Feb 10, 2026 · nl

Vendor: Microsoft Product: ACI Confidential Containers Product: Azure Product: Azure AI Language Authoring Product: Azure ARC Product: Azure DevOps Server 2022 Product: Azure Front Door Product: Azure Functions Product: Azure HDInsight Product: Azure IoT Explorer Product: Azure Local

Summary

Microsoft heeft kwetsbaarheden verholpen in diverse Azure componenten.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om zich voor te doen als andere gebruiker, zich mogelijk verhoogde rechten toe te kennen en zo willekeurige code uit te voeren of toegang te krijgen tot gevoelige gegevens.

Van de kwetsbaarheden met kenmerk CVE-2026-21532, CVE-2026-24300 en CVE-2026-24302 meldt Microsoft dat deze in hun centrale Azure-infrastructuur zijn verholpen en dat deze kwetsbaarheden geen actie van gebruikers vereist. Deze kwetsbaarheden zijn ter informatie opgenomen.

```
Azure Front Door (AFD):
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-24300 | 9.80 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|

Azure Function:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-21532 | 8.20 | Toegang tot gevoelige gegevens |
|----------------|------|-------------------------------------|

Azure HDInsights:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-21529 | 5.70 | Voordoen als andere gebruiker |
|----------------|------|-------------------------------------|

Azure Compute Gallery:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-23655 | 6.50 | Toegang tot gevoelige gegevens |
| CVE-2026-21522 | 6.70 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|

Azure Local:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-21228 | 8.10 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|

Azure Arc:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-24302 | 8.60 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|

Azure IoT SDK:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-21528 | 6.50 | Toegang tot gevoelige gegevens |
|----------------|------|-------------------------------------|

Azure DevOps Server:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-21512 | 6.50 | Voordoen als andere gebruiker |
|----------------|------|-------------------------------------|

Azure SDK:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-21531 | 9.80 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|

```

Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:

https://portal.msrc.microsoft.com/en-us/security-guidance

Vulnerabilities 10

  • Critical 9.8
    CVE-2026-21531 Public exploit

    Azure SDK for Python Remote Code Execution Vulnerability

    Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.

    Microsoft Azure AI Language Authoring azure-ai-language-conversations-authoring PyPI
  • Critical 9.8
    CVE-2026-24300

    Azure Front Door Elevation of Privilege Vulnerability

    Azure Front Door Elevation of Privilege Vulnerability

    Microsoft Azure Front Door
  • High 8.6
    CVE-2026-24302

    Azure Arc Elevation of Privilege Vulnerability

    Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure ARC
  • High 8.2
    CVE-2026-21532

    Azure Function Information Disclosure Vulnerability

    Azure Function Information Disclosure Vulnerability

    Microsoft Azure Functions
  • High 8.1
    CVE-2026-21228

    Azure Local Remote Code Execution Vulnerability

    Improper certificate validation in Azure Local allows an unauthorized attacker to execute code over a network.

    Microsoft Azure Local
  • Medium 6.7
    CVE-2026-21522

    Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability

    Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.

    Microsoft Microsoft ACI Confidential Containers
  • Medium 6.5
    CVE-2026-21512

    Azure DevOps Server Cross-Site Scripting Vulnerability

    Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to perform spoofing over a network.

    Microsoft Azure DevOps Server 2022
  • Medium 6.5
    CVE-2026-21528

    Azure IoT Explorer Information Disclosure Vulnerability

    Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.

    Microsoft Azure IoT Explorer
  • Medium 6.5
    CVE-2026-23655

    Microsoft ACI Confidential Containers Information Disclosure Vulnerability

    Cleartext storage of sensitive information in Azure Compute Gallery allows an authorized attacker to disclose information over a network.

    Microsoft Microsoft ACI Confidential Containers
  • Medium 5.7
    CVE-2026-21529

    Azure HDInsight Spoofing Vulnerability

    Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an authorized attacker to perform spoofing over a network.

    Microsoft Azure HDInsight

Revision history

  1. #1.0.0

    Initiele versie