Skip to content
OpenAdvisories
High WID-SEC-2026-0201 8 CVEs

Microsoft Azure, Copilot und Entra: Mehrere Schwachstellen

Published Jan 22, 2026 · Updated Jan 25, 2026 · Revision 2 · de-DE

Vendor: Microsoft Product: 365 Copilot Product: Azure Product: Entra Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Microsoft Azure, Microsoft 365 Copilot und Microsoft Entra ausnutzen, um seine Privilegien zu erhöhen, Cross-Site-Scripting-Angriffe durchzuführen und vertrauliche Informationen offenzulegen.

Product

Azure ist eine Cloud Computing-Plattform von Microsoft.
Microsoft Copilot ist ein KI-Assistent, der in verschiedene Microsoft-Produkte integriert werden kann.
Microsoft Entra ID (früher Azure Active Directory) ist ein cloudbasierter Identitäts- und Zugriffsverwaltungsdienst von Microsoft.

Vulnerabilities 8

  • Critical 9.9
    CVE-2026-24304

    Azure Resource Manager Elevation of Privilege Vulnerability

    Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure Resource Manager
  • Critical 9.8
    CVE-2026-24306 Public exploit

    Azure Front Door Elevation of Privilege Vulnerability

    Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Front Door
  • Critical 9.3
    CVE-2026-21264

    Microsoft Account Spoofing Vulnerability

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Microsoft Account
  • Critical 9.3
    CVE-2026-24305

    Azure Entra ID Elevation of Privilege Vulnerability

    Azure Entra ID Elevation of Privilege Vulnerability

    Microsoft Microsoft Entra
  • Critical 9.3
    CVE-2026-24307

    M365 Copilot Information Disclosure Vulnerability

    Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.

    Microsoft Microsoft 365 Copilot
  • High 8.2
    CVE-2026-21227

    Azure Logic Apps Elevation of Privilege Vulnerability

    Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Logic Apps
  • High 7.4
    CVE-2026-21521

    Word Copilot Information Disclosure Vulnerability

    Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network.

    Microsoft Microsoft 365 Word Copilot
  • High 7.4
    CVE-2026-21524

    Azure Data Explorer Information Disclosure Vulnerability

    Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network.

    Microsoft Azure Data Explorer

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-4507, EUVD-2026-4498, EUVD-2026-4497, EUVD-2026-4506, EUVD-2026-4501, EUVD-2026-4496, EUVD-2026-4494, EUVD-2026-4493

  2. #1

    Initiale Fassung

References