Summary
Ein Angreifer kann mehrere Schwachstellen in Microsoft Windows Admin Center, Microsoft Azure und Microsoft Azure Linux ausnutzen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, und um falsche Informationen darzustellen.
Product
Microsoft Windows Admin Center ist ein webbasiertes Tool zur Verwaltung von Windows Servern, Clustern und PCs.
Azure ist eine Cloud Computing-Plattform von Microsoft.
Microsoft Azure Linux ist eine von Microsoft entwickelte Linux-Distribution, die für die Ausführung von Workloads in der Azure-Cloud optimiert ist.
Vulnerabilities 13
-
High 8.8CVE-2026-26118 Public exploit
Azure MCP Server Tools Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.
-
High 8.1
Microsoft Azure AD SSH Login extension for Linux Elevation of Privilege Vulnerability
External initialization of trusted variables or data stores in Azure Entra ID allows an unauthorized attacker to elevate privileges locally.
-
High 7.8
Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability
Improper access control in Azure Portal Windows Admin Center allows an authorized attacker to elevate privileges locally.
-
High 7.8
Linux Azure Diagnostic extension (LAD) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Azure Linux Virtual Machines allows an authorized attacker to elevate privileges locally.
-
High 7.8
Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability
Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally.
-
High 7.8
Hybrid Worker Extension (Arc‑enabled Windows VMs) Elevation of Privilege Vulnerability
Improper authentication in Azure Arc allows an authorized attacker to elevate privileges locally.
-
High 7.5
Azure IoT Explorer Information Disclosure Vulnerability
Cleartext transmission of sensitive information in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.
-
High 7.5
Azure IoT Explorer Information Disclosure Vulnerability
Missing authentication for critical function in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.
-
High 7.5
Azure IoT Explorer Information Disclosure Vulnerability
Improper restriction of communication channel to intended endpoints in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.
-
High 7.5
Azure IOT Explorer Spoofing Vulnerability
Server-side request forgery (ssrf) in Azure IoT Explorer allows an unauthorized attacker to perform spoofing over a network.
-
Medium 6.7
Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability
Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.
-
Medium 6.7
Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability
'.../...//' in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.
-
Medium 6.5
Microsoft ACI Confidential Containers Information Disclosure Vulnerability
Initialization of a resource with an insecure default in Azure Compute Gallery allows an authorized attacker to disclose information over a network.
Revision history
-
#1
Initiale Fassung
References
-
Microsoft Leitfaden für Sicherheitsupdates
https://msrc.microsoft.com/update-guide/