Summary
Microsoft heeft kwetsbaarheden verholpen in diverse Azure componenten.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, beveiligingsmaatregelen te omzeilen of zich verhoogde rechten toe te kennen en zo mogelijk toegang te krijgen tot gegevens waartoe de kwaadwillende aanvankelijk niet is geautoriseerd.
De ernstigste kwetsbaarheden bevonden zich in de OpenAI agent en Entra provisioning. Deze kwetsbaarheden zijn echter door Microsoft centraal reeds verholpen en slechts opgenomen ter informatie. Er zijn voor deze kwetsbaarheden geen acties vereist.
```
Azure CycleCloud:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-57969 | 8.80 | Verkrijgen van verhoogde rechten |
| CVE-2026-58279 | 6.50 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Microsoft Entra Provisioning Service (SyncFabric):
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-57100 | 9.90 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Azure Monitor Agent:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-47632 | 8.80 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Azure Spring Apps:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-50338 | 8.20 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Azure Active Directory:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-50652 | 7.50 | Denial-of-Service |
| CVE-2026-50653 | 7.50 | Denial-of-Service |
|----------------|------|-------------------------------------|
Azure OpenAI:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-45499 | 9.90 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
Azure Synapse:
|----------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|----------------|------|-------------------------------------|
| CVE-2026-26145 | 4.80 | Verkrijgen van verhoogde rechten |
|----------------|------|-------------------------------------|
```
Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Vulnerabilities 9
-
Critical 9.9
Azure OpenAI Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.
-
Critical 9.9
Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Azure Connected Machine Agent Elevation of Privilege Vulnerability
Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network.
-
High 8.8
Azure CycleCloud Elevation of Privilege Vulnerability
Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
-
High 8.2CVE-2026-50338 Public exploit
Azure Spring Apps Elevation of Privilege Vulnerability
Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network.
-
High 7.5
Azure Active Directory Denial of Service Vulnerability
Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network.
-
High 7.5
Azure Active Directory Denial of Service Vulnerability
Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.
-
Medium 6.5
Azure CycleCloud Elevation of Privilege Vulnerability
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
-
Medium 4.8
Microsoft Azure Synapse Elevation of Privilege Vulnerability
Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network.
Revision history
-
#1.0.0
Initiele versie