Skip to content
OpenAdvisories
Critical WID-SEC-2026-1792 6 CVEs

Microsoft Clouddienste: Mehrere Schwachstellen ermöglichen Privilegieneskalation

Published Jun 4, 2026 · Updated Jun 15, 2026 · Revision 2 · de-DE

Vendor: Microsoft Product: 365 Copilot Product: Azure Product: Edge Product: Exchange Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in verschiedenen Microsoft Clouddiensten wie Azure HorizonDB, Exchange Online, 365 Copilot und dem Copilot Chat in Edge ausnutzen, um seine Privilegien zu erweitern, um beliebigen Code auszuführen und um Informationen offenzulegen.

Product

Azure ist eine Cloud Computing-Plattform von Microsoft.
Exchange ist ein Groupware und Nachrichtensystem der Firma Microsoft.
Microsoft Copilot ist ein KI-Assistent, der in verschiedene Microsoft-Produkte integriert werden kann.
Edge ist ein Web Browser von Microsoft.

Vulnerabilities 6

  • Critical 10.0
    CVE-2026-48567

    Azure HorizonDB Elevation of Privilege Vulnerability

    Authentication bypass by spoofing in Azure HorizonDB allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure HorizonDB
  • Critical 9.1
    CVE-2026-48579

    Microsoft Exchange Online Information Disclosure Vulnerability

    Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.

    Microsoft Microsoft Exchange Online
  • High 7.7
    CVE-2026-45497

    Microsoft M365 Copilot Remote Code Execution Vulnerability

    Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.

    Microsoft Microsoft 365 Copilot
  • Medium 6.5
    CVE-2026-42824

    M365 Copilot Information Disclosure Vulnerability

    Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

    Microsoft Microsoft 365 Copilot
  • Medium 6.5
    CVE-2026-47644 Public exploit

    Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability

    Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.

    Microsoft Copilot Chat (Microsoft Edge) Browsers
  • Medium 6.5
    CVE-2026-47655

    Microsoft Graph Information Disclosure Vulnerability

    Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network.

    Microsoft Microsoft Graph

Revision history

  1. #2

    PoC aufgenommen CVE-2026-42824

  2. #1

    Initiale Fassung

References