Skip to content
OpenAdvisories
High WID-SEC-2026-1419 8 CVEs

Microsoft Azure: Mehrere Schwachstellen

Published May 7, 2026 · Updated May 12, 2026 · Revision 2 · de-DE

Vendor: Microsoft Product: Azure Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Microsoft Azure ausnutzen, um beliebigen Programmcode auszuführen, erhöhte Privilegien zu erlangen oder Spoofing-Angriffe durchzuführen.

Product

Azure ist eine Cloud Computing-Plattform von Microsoft.
Microsoft Azure DevOps Server ist eine Plattform für kollaborative Softwareprojekte.

Vulnerabilities 8

  • Critical 9.9
    CVE-2026-33109

    Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

    Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.

    Microsoft Azure Managed Instance for Apache Cassandra
  • Critical 9.6
    CVE-2026-35428

    Azure Cloud Shell Spoofing Vulnerability

    Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Azure Cloud Shell
  • Critical 9.3
    CVE-2026-40379

    Azure Entra ID Spoofing Vulnerability

    Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Microsoft Entra
  • Critical 9.0
    CVE-2026-33844

    Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

    Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.

    Microsoft Azure Managed Instance for Apache Cassandra
  • High 8.8
    CVE-2026-32207

    Azure Machine Learning Notebook Spoofing Vulnerability

    Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Azure Machine Learning
  • High 8.6
    CVE-2026-35435

    Azure AI Foundry Elevation of Privilege Vulnerability

    Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure AI Foundry
  • High 8.2
    CVE-2026-34327

    Microsoft Partner Center Spoofing Vulnerability

    Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Microsoft Partner Center
  • High 8.1
    CVE-2026-41105

    Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability

    Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure Monitor Action Group notification system

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-29655

  2. #1

    Initiale Fassung

References