Summary
Microsoft heeft kwetsbaarheden verholpen in diverse Azure componenten, zoals Key Vault, DevOps, API center en Storage.
Details
Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om beveiligingsmaatregelen te omzeilen, zich verhoogde rechten toe te kennen, willekeurige code uit te voeren en toegang te krijgen tot gevoelige gegevens.
De kwetsbaarheden met kenmerk CVE-2026-83943, CVE-2026-96207, CVE-2026-69435 en CVE-2026-83947 zijn reeds centraal door Microsoft verholpen en vereisen geen verdere acties. Deze zijn ter informatie opgenomen.
Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:
Vulnerabilities 11
-
Critical 10.0
Microsoft Partner Center Elevation of Privilege Vulnerability
Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.6
Azure SRE Agent Elevation of Privilege Vulnerability
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
-
High 8.7
Azure API Center Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network.
-
High 8.2
Azure Key Vault Client SDK Elevation of Privilege Vulnerability
Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.
-
High 8.1
Azure Storage Library Elevation of Privilege Vulnerability
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges over a network.
-
High 7.7
Azure Event Grid Spoofing Vulnerability
Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.
-
High 7.4
Azure Key Vault Security Feature Bypass Vulnerability
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
-
High 7.3
Azure CycleCloud Remote Code Execution Vulnerability
Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.
-
Medium 6.5
Azure DevOps Information Disclosure Vulnerability
Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.
-
Medium 6.5
Azure Arc Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.
-
Medium 5.9
Azure Key Vault Information Disclosure Vulnerability
Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.
Revision history
-
#1.0.0
Initiele versie