Summary
Ein Angreifer kann mehrere Schwachstellen in Microsoft Azure, Microsoft 365 Copilot, Microsoft Exchange und Microsoft Apps Surface ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.
Product
Azure ist eine Cloud Computing-Plattform von Microsoft.
Microsoft Copilot ist ein KI-Assistent, der in verschiedene Microsoft-Produkte integriert werden kann.
Exchange ist ein Groupware und Nachrichtensystem der Firma Microsoft.
Microsoft bietet in der Apps-Produktfamilie zahlreiche Anwendungen für mobile Endgeräte an.
Vulnerabilities 13
-
Critical 10.0
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Microsoft Exchange Online Tampering Vulnerability
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
-
Critical 10.0
Data Quality Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure DNS Elevation of Privilege Vulnerability
Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure Key Vault Elevation of Privilege Vulnerability
Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.9
Microsoft M365 Copilot Remote Code Execution Vulnerability
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.
-
Critical 9.9
Microsoft Surface Remote Code Execution Vulnerability
Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network.
-
Critical 9.8
Microsoft Account Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.
-
Critical 9.1
Azure Red Hat OpenShift (ARO) Elevation of Privilege Vulnerability
Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.
-
High 8.5
Azure AI Search Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network.
-
High 8.0
Azure API Management (APIM) Remote Code Execution Vulnerability
Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.
-
Medium 6.5
Microsoft Graph Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network.
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2026-48603, EUVD-2026-48602, EUVD-2026-48601
-
#1
Initiale Fassung
References
-
Microsoft Security Advisory CVE-2026-35425 vom 2026-07-23
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35425
-
Microsoft Security Advisory CVE-2026-49159 vom 2026-07-23
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49159
-
Microsoft Security Advisory CVE-2026-56160 vom 2026-07-23
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56160
-
Microsoft Security Advisory CVE-2026-56163 vom 2026-07-23
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56163
-
Microsoft Security Advisory CVE-2026-56165 vom 2026-07-23
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56165
-
Microsoft Security Advisory CVE-2026-56167 vom 2026-07-23
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56167
-
Microsoft Security Advisory CVE-2026-57106 vom 2026-07-23
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57106
-
Microsoft Security Advisory CVE-2026-58275 vom 2026-07-23
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58275
-
Microsoft Security Advisory CVE-2026-58630 vom 2026-07-23
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58630
-
Microsoft Security Advisory CVE-2026-62825 vom 2026-07-23
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62825
-
Microsoft Security Advisory CVE-2026-50517 vom 2026-07-23
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50517
-
Microsoft Security Advisory CVE-2026-56191 vom 2026-07-23
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56191
-
Microsoft Security Advisory CVE-2026-54120 vom 2026-07-23
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54120
-
Microsoft Leitfaden für Sicherheitsupdates vom 2026-07-23
https://msrc.microsoft.com/update-guide/