Skip to content
OpenAdvisories
Critical 1 exploited CVE WID-SEC-2026-2951 17 CVEs

Microsoft Azure, Entra ID und Exchange: Mehrere Schwachstellen

Published Aug 20, 2026 · Updated Oct 15, 2026 · Revision 3 · de-DE

Vendor: Microsoft Product: 365 Copilot Product: Azure Product: Entra Product: Exchange Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Microsoft Azure, Microsoft Entra ID und Microsoft Exchange Online ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern oder vertrauliche Informationen offenzulegen.

Product

Azure ist eine Cloud Computing-Plattform von Microsoft.
Microsoft Copilot ist ein KI-Assistent, der in verschiedene Microsoft-Produkte integriert werden kann.
Microsoft Entra ID (früher Azure Active Directory) ist ein cloudbasierter Identitäts- und Zugriffsverwaltungsdienst von Microsoft.
Exchange ist ein Groupware und Nachrichtensystem der Firma Microsoft.

Vulnerabilities 17

  • Critical 10.0
    CVE-2026-69836 Exploited Public exploit

    Microsoft Entra ID Remote Code Execution Vulnerability

    Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

    Microsoft Microsoft Entra
  • Critical 10.0
    CVE-2026-65770

    Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

    Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network.

    Microsoft Azure Managed Instance for Apache Cassandra
  • Critical 10.0
    CVE-2026-65801

    Microsoft Exchange Online Elevation of Privilege Vulnerability

    Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Microsoft Exchange Online
  • Critical 10.0
    CVE-2026-65816

    Azure Arc Elevation of Privilege Vulnerability

    Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Web Apps
  • Critical 10.0
    CVE-2026-69502

    Azure SQL Database Elevation of Privilege Vulnerability

    Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure SQL Database
  • Critical 10.0
    CVE-2026-69555

    Azure Arc Elevation of Privilege Vulnerability

    Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure ARC
  • Critical 9.9
    CVE-2026-68782

    Azure SQL Database Elevation of Privilege Vulnerability

    Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure SQL Database
  • Critical 9.9
    CVE-2026-68789

    Azure SQL Database Elevation of Privilege Vulnerability

    Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure SQL Database
  • Critical 9.9
    CVE-2026-69851

    Microsoft Entra ID Elevation of Privilege Vulnerability

    Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.

    Microsoft Microsoft Entra
  • Critical 9.6
    CVE-2026-69400

    Azure Logic Apps Elevation of Privilege Vulnerability

    Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Logic Apps
  • Critical 9.3
    CVE-2026-62834

    Azure Data Factory Elevation of Privilege Vulnerability

    Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Data Factory
  • Critical 9.1
    CVE-2026-66309

    Azure SQL Database Elevation of Privilege Vulnerability

    Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure SQL Database
  • High 8.6
    CVE-2026-66800

    Azure Data Factory Information Disclosure Vulnerability

    Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.

    Microsoft Azure Data Factory
  • High 8.6
    CVE-2026-69519

    Azure Stack HCI Information Disclosure Vulnerability

    Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.

    Microsoft Azure Stack HCI
  • High 8.5
    CVE-2026-69419

    Azure Data Manager for Energy Remote Code Execution Vulnerability

    Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.

    Microsoft Azure Data Manager for Energy
  • High 8.5
    CVE-2026-69543

    Azure Virtual Machines Elevation of Privilege Vulnerability

    Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure Virtual Machines
  • High 7.7
    CVE-2026-69855

    Microsoft Copilot in Azure Information Disclosure Vulnerability

    Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network.

    Microsoft Microsoft Copilot in Azure

Revision history

  1. #3

    Tippfehler korrigiert

  2. #2

    Referenz(en) aufgenommen: EUVD-2026-63994

  3. #1

    Initiale Fassung

References