Skip to content
OpenAdvisories
High NCSC-2026-0475 19 CVEs

Kwetsbaarheden verholpen in Microsoft Azure

Published Nov 10, 2026 · Updated Nov 10, 2026 · nl

Vendor: Microsoft Product: @azure/msal-node Product: Authentication Library (MSAL) for .NET on Windows Product: Authentication Library for JavaScript Product: Azure CycleCloud 8.9.1 Product: Azure CycleCloud 8.9.2 Product: Azure CycleCloud 8.9.2 on Linux Product: Azure File Sync v21 Product: Azure File Sync v22 Product: Azure File Sync v23 Product: Azure Front Door Product: Azure Identity SDK for Java Product: Azure Local on Azure Linux 3.0 Product: Azure Machine Learning Product: Azure Managed Grafana Product: Azure Open AI Product: Azure Privileged Identity Management (PIM) Product: Azure Virtual Machines Product: Azure Web Apps Product: Entra Private Network Connector Product: Identity Manager

Summary

Microsoft heeft meerdere kwetsbaarheden verholpen in diverse Azure componenten.

Details

Interpretaties
Een kwaadwillende kan de kwetsbaarheden misbruiken om aanvallen uit te voeren die kunnen leiden tot de categorieën schade, zoals genoemd in onderstaande tabel.

De kwetsbaarheid met kenmerk CVE-2026-119990, met een CVSS-score van 9.8 betreft ontbrekende authenticatie voor een kritieke functie in Azure OpenAI. Een ongeautoriseerde kwaadwillende kan deze kwetsbaarheid via het netwerk misbruiken om verhoogde rechten te verkrijgen. Voor de kwetsbaarheid met kenmerk CVE-2026-114162, met een CVSS-score van 9.1 geldt dat een geautoriseerde kwaadwillende door onvoldoende autorisatiecontroles in Microsoft Graph via het netwerk verhoogde rechten kan verkrijgen voor Microsoft Azure.

```
Azure File Sync:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-118288 | 7,00 | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|

Azure Managed Grafana:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-114160 | onb. | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|

Azure Local:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-105734 | 7,00 | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|

Azure OpenAI:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-119990 | 9,80 | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|

Microsoft Graph:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-114162 | 9,10 | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|

Azure CycleCloud:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-102224 | 8,40 | Verkrijgen van verhoogde rechten |
| CVE-2026-113822 | 6,50 | Verkrijgen van verhoogde rechten |
| CVE-2026-113823 | 7,50 | Toegang tot gevoelige gegevens |
| CVE-2026-114161 | 7,80 | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|

Azure Front Door (AFD):
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-118742 | 8,60 | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|

Microsoft Entra Private Network Connector:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-109460 | 5,50 | Toegang tot gevoelige gegevens |
|------------------|------|-------------------------------------|

Microsoft Authentication Library for JavaScript:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-108469 | 6,80 | Voordoen als andere gebruiker |
|------------------|------|-------------------------------------|

Azure Firmware:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-109462 | 4,40 | Omzeilen van beveiligingsmaatregel |
|------------------|------|-------------------------------------|

Azure CLI:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-109457 | 8,00 | Uitvoeren van willekeurige code |
|------------------|------|-------------------------------------|

Microsoft Authentication Library (MSAL) for Node.js:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-108470 | onb. | Toegang tot gevoelige gegevens |
|------------------|------|-------------------------------------|

Microsoft Authentication Library (MSAL) for .NET:
|------------------|------|-------------------------------------|

Azure Pipelines:
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-119989 | 8,20 | Uitvoeren van willekeurige code |
|------------------|------|-------------------------------------|

Azure NFS mount helper (aznfs):
|------------------|------|-------------------------------------|
| CVE-ID | CVSS | Impact |
|------------------|------|-------------------------------------|
| CVE-2026-105494 | onb. | Verkrijgen van verhoogde rechten |
|------------------|------|-------------------------------------|

```

Oplossingen
Microsoft heeft updates beschikbaar gesteld waarmee de beschreven kwetsbaarheden worden verholpen. We raden u aan om deze updates te installeren. Meer informatie over de kwetsbaarheden, de installatie van de updates en eventuele work-arounds vindt u op:

https://portal.msrc.microsoft.com/en-us/security-guidance

Vulnerabilities 19

  • Critical 9.9
    CVE-2026-109467

    Azure DevOps Server Remote Code Execution Vulnerability

    Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.

    Microsoft Azure DevOps Azure DevOps Server 2025
  • Critical 9.8
    CVE-2026-114160

    Azure Managed Grafana Elevation of Privilege Vulnerability

    Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Managed Grafana Web / CMS
  • Critical 9.8
    CVE-2026-119990

    Azure OpenAI Elevation of Privilege Vulnerability

    Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Open AI
  • High 8.8
    CVE-2026-85923

    Azure DevOps Server Elevation of Privilege Vulnerability

    Authorization bypass through user-controlled key in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure DevOps Server
  • High 8.6
    CVE-2026-118742

    Azure Front Door Elevation of Privilege Vulnerability

    Incorrect permission assignment for critical resource in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Front Door
  • High 8.4
    CVE-2026-102224

    Azure CycleCloud Elevation of Privilege Vulnerability

    Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure CycleCloud 8.9.1
  • High 8.2
    CVE-2026-119989

    Azure Pipelines Remote Code Execution Vulnerability

    Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.

    Microsoft Azure Web Apps
  • High 8.0
    CVE-2026-109457

    Azure CLI Remote Code Execution Vulnerability

    Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network.

    Microsoft Azure Machine Learning
  • High 7.8
    CVE-2026-105494

    Azure NFS mount helper (aznfs) Elevation of Privilege Vulnerability

    Untrusted search path in Azure NFS mount helper (aznfs) allows an authorized attacker to elevate privileges locally.

    Microsoft aznfs
  • High 7.8
    CVE-2026-114161

    Azure CycleCloud Elevation of Privilege Vulnerability

    Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an authorized attacker to elevate privileges locally.

    Microsoft Azure CycleCloud 8.9.2
  • High 7.8
    CVE-2026-122986

    Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

    Improper privilege management in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges locally.

    Microsoft kernel-mshv-6.6.137.mshv2-2.azl3.x86_64
  • High 7.7
    CVE-2026-121668

    Azure Confidential Clean Rooms Tampering Vulnerability

    Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network.

    Microsoft Azure Confidential Clean Room
  • High 7.5
    CVE-2026-113823

    Azure CycleCloud Information Disclosure Vulnerability

    Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an unauthorized attacker to disclose information over a network.

    Microsoft Azure CycleCloud 8.9.2
  • High 7.0
    CVE-2026-105734

    Azure Local Elevation of Privilege Vulnerability

    Incorrect permission assignment for critical resource in Azure Local allows an authorized attacker to elevate privileges locally.

    Microsoft Azure Local
  • High 7.0
    CVE-2026-118288

    Microsoft Azure File Sync Elevation of Privilege Vulnerability

    Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally.

    Microsoft Azure File Sync Azure File Sync v22
  • Medium 6.5
    CVE-2026-112745

    Azure DevOps Server Information Disclosure Vulnerability

    Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to disclose information over a network.

    Microsoft Azure DevOps Server Azure DevOps
  • Medium 6.5
    CVE-2026-113822

    Azure CycleCloud Elevation of Privilege Vulnerability

    Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure CycleCloud 8.9.1
  • Medium 6.4
    CVE-2026-120783

    Azure DevOps Server Elevation of Privilege Vulnerability

    Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure DevOps Server 2025
  • Medium 4.4
    CVE-2026-109462

    Azure Firmware Security Feature Bypass Vulnerability

    Improper check for certificate revocation in Azure Firmware allows an authorized attacker to bypass a security feature locally.

    Microsoft Azure Virtual Machines

Revision history

  1. #1.0.0

    Initiele versie

References

  • Reference
    https://portal.msrc.microsoft.com/en-us/security-guidance