Skip to content
OpenAdvisories
High NCSC-2026-0142 16 CVEs

Kwetsbaarheden verholpen in Microsoft Azure

Published May 12, 2026 · Updated May 12, 2026 · nl

Vendor: Microsoft Product: Azure Product: Azure AI Foundry Product: Azure Cloud Shell Product: Azure Connected Machine Agent Product: Azure Logic Apps Product: Azure Machine Learning Product: Azure Managed Instance for Apache Cassandra Product: Azure Monitor Action Group notification system Product: Azure Monitor Agent Product: Azure Monitor Agent Metrics Extension Product: Azure SDK for Java Product: Confluence SAML SSO plugin Product: Enterprise Security Token Service (ESTS) Product: JIRA SAML SSO plugin Product: Partner Center Product: Windows Admin Center in Azure Portal

Summary

Microsoft heeft kwetsbaarheden verholpen in diverse Azure componenten.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om zich voor te doen als andere gebruiker, zich verhoogde rechten toe te kennen, willekeurige code uit te voeren en mogelijk daarmee toegang te krijgen tot gevoelige gegevens.

De kwetsbaarheden met kenmerk CVE-2026-40379, CVE-2026-32207, CVE-2026-33109, CVE-2026-33844, CVE-2026-34327, CVE-2026-35428, CVE-2026-35435 en CVE-2026-41105 zijn reeds centraal verholpen door Microsoft en slechts opgenomen ter informatie. Voor deze kwetsbaarheden zijn geen acties benodigd.

```
Azure Machine Learning:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-32207 | 8.80 | Voordoen als andere gebruiker |
| CVE-2026-33833 | 8.20 | Voordoen als andere gebruiker |
|----------------|------|-------------------------------------|

Azure Monitor Agent:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-32204 | 7.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-42830 | 6.50 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|

Microsoft Partner Center:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-34327 | 8.20 | Voordoen als andere gebruiker |
|----------------|------|-------------------------------------|

Azure Connected Machine Agent:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-40381 | 7.80 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|

Azure SDK:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-33117 | 9.10 | Omzeilen van beveiligingsmaatregel |
|----------------|------|-------------------------------------|

Microsoft SSO Plugin for Jira & Confluence:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-41103 | 9.10 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|

Azure Notification Service:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-41105 | 8.10 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|

Azure Logic Apps:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-42823 | 9.90 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|

Azure Entra ID:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-40379 | 9.30 | Voordoen als andere gebruiker |
|----------------|------|-------------------------------------|

Windows Admin Center:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-41086 | 8.80 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|

Azure AI Foundry M365 published agents:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-35435 | 8.60 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|

Azure Cloud Shell:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-35428 | 9.60 | Voordoen als andere gebruiker |
|----------------|------|-------------------------------------|

Azure Managed Instance for Apache Cassandra:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-33109 | 9.90 | Uitvoeren van willekeurige code |
| CVE-2026-33844 | 9.00 | Uitvoeren van willekeurige code |
|----------------|------|-------------------------------------|
```

Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:

https://portal.msrc.microsoft.com/en-us/security-guidance

Vulnerabilities 16

  • Critical 9.9
    CVE-2026-33109

    Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

    Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.

    Microsoft Azure Managed Instance for Apache Cassandra
  • Critical 9.9
    CVE-2026-42823

    Azure Logic Apps Elevation of Privilege Vulnerability

    Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure Logic Apps
  • Critical 9.6
    CVE-2026-35428

    Azure Cloud Shell Spoofing Vulnerability

    Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Azure Cloud Shell
  • Critical 9.3
    CVE-2026-40379

    Azure Entra ID Spoofing Vulnerability

    Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Microsoft Entra
  • Critical 9.1
    CVE-2026-33117

    Azure SDK for Java Security Feature Bypass Vulnerability

    The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path,…

    Microsoft Azure SDK for Java apache-nifi com.azure:azure-security-keyvault-keys Wolfi Maven
  • Critical 9.1
    CVE-2026-41103

    Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability

    Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Microsoft JIRA SAML SSO plugin Microsoft Confluence SAML SSO plugin Web / CMS
  • Critical 9.0
    CVE-2026-33844

    Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

    Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.

    Microsoft Azure Managed Instance for Apache Cassandra
  • High 8.8
    CVE-2026-32207

    Azure Machine Learning Notebook Spoofing Vulnerability

    Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Azure Machine Learning
  • High 8.8
    CVE-2026-41086

    Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability

    Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

    Microsoft Windows Admin Center in Azure Portal Windows
  • High 8.6
    CVE-2026-35435

    Azure AI Foundry Elevation of Privilege Vulnerability

    Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure AI Foundry
  • High 8.2
    CVE-2026-33833

    Azure Machine Learning Notebook Spoofing Vulnerability

    Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Azure Machine Learning
  • High 8.2
    CVE-2026-34327

    Microsoft Partner Center Spoofing Vulnerability

    Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Microsoft Partner Center
  • High 8.1
    CVE-2026-41105

    Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability

    Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure Monitor Action Group notification system
  • High 7.8
    CVE-2026-32204

    Azure Monitor Agent Elevation of Privilege Vulnerability

    External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.

    Microsoft Azure Monitor
  • High 7.8
    CVE-2026-40381

    Azure Connected Machine Agent Elevation of Privilege Vulnerability

    Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.

    Microsoft Azure Connected Machine Agent
  • Medium 6.5
    CVE-2026-42830

    Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability

    Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.

    Microsoft Azure Monitor Agent Metrics Extension

Revision history

  1. #1.0.0

    Initiele versie