Skip to content
OpenAdvisories
High WID-SEC-2026-0370 10 CVEs

Microsoft Azure-Produkte: Mehrere Schwachstellen

Published Feb 10, 2026 · Updated Feb 10, 2026 · de-DE

Vendor: Microsoft Product: Azure Product: Azure DevOps Server Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Microsoft Azure und Microsoft Azure DevOps Server ausnutzen, um sich erweiterte Berechtigungen zu verschaffen, beliebigen Code auszuführen – sogar mit Administratorrechten –, Spoofing-Angriffe durchzuführen und vertrauliche Informationen offenzulegen.

Product

Azure ist eine Cloud Computing-Plattform von Microsoft.
Microsoft Azure DevOps Server ist eine Plattform für kollaborative Softwareprojekte.

Vulnerabilities 10

  • Critical 9.8
    CVE-2026-21531 Public exploit

    Azure SDK for Python Remote Code Execution Vulnerability

    Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.

    Microsoft Azure AI Language Authoring azure-ai-language-conversations-authoring PyPI
  • Critical 9.8
    CVE-2026-24300

    Azure Front Door Elevation of Privilege Vulnerability

    Azure Front Door Elevation of Privilege Vulnerability

    Microsoft Azure Front Door
  • High 8.6
    CVE-2026-24302

    Azure Arc Elevation of Privilege Vulnerability

    Improper access control in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure ARC
  • High 8.2
    CVE-2026-21532

    Azure Function Information Disclosure Vulnerability

    Azure Function Information Disclosure Vulnerability

    Microsoft Azure Functions
  • High 8.1
    CVE-2026-21228

    Azure Local Remote Code Execution Vulnerability

    Improper certificate validation in Azure Local allows an unauthorized attacker to execute code over a network.

    Microsoft Azure Local
  • Medium 6.7
    CVE-2026-21522

    Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability

    Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.

    Microsoft Microsoft ACI Confidential Containers
  • Medium 6.5
    CVE-2026-21512

    Azure DevOps Server Cross-Site Scripting Vulnerability

    Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to perform spoofing over a network.

    Microsoft Azure DevOps Server 2022
  • Medium 6.5
    CVE-2026-21528

    Azure IoT Explorer Information Disclosure Vulnerability

    Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.

    Microsoft Azure IoT Explorer
  • Medium 6.5
    CVE-2026-23655

    Microsoft ACI Confidential Containers Information Disclosure Vulnerability

    Cleartext storage of sensitive information in Azure Compute Gallery allows an authorized attacker to disclose information over a network.

    Microsoft Microsoft ACI Confidential Containers
  • Medium 5.7
    CVE-2026-21529

    Azure HDInsight Spoofing Vulnerability

    Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an authorized attacker to perform spoofing over a network.

    Microsoft Azure HDInsight

Revision history

  1. #1

    Initiale Fassung

References