Summary
Ein Angreifer kann mehrere Schwachstellen in verschiedenen Microsoft Clouddiensten ausnutzen, um Sicherheitsmechanismen zu umgehen, Berechtigungen zu erhöhen, vertrauliche Informationen offenzulegen sowie Daten oder Dienste zu beeinträchtigen.
Product
Azure ist eine Cloud Computing-Plattform von Microsoft.
Azure Cosmos DB ist ein NoSQL-Datenbankdienst von Microsoft.
Microsoft Copilot ist ein KI-Assistent, der in verschiedene Microsoft-Produkte integriert werden kann.
Microsoft Entra ID (früher Azure Active Directory) ist ein cloudbasierter Identitäts- und Zugriffsverwaltungsdienst von Microsoft.
Vulnerabilities 9
-
Critical 10.0
Azure AI Language Elevation of Privilege Vulnerability
Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.9
Entra ID Elevation of Privilege Vulnerability
Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.
-
Critical 9.3
Copilot Studio Elevation of Privilege Vulnerability
Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.1
Microsoft Entra ID Elevation of Privilege Vulnerability
Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
-
High 8.5
Power Automate Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.
-
High 8.5
Azure Cosmos DB Spoofing Vulnerability
Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network.
-
High 8.5
Microsoft Fabric Elevation of Privilege Vulnerability
Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.
-
High 7.4
Microsoft Discovery Studio Information Disclosure Vulnerability
Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network.
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2026-73173
-
#1
Initiale Fassung
References
-
Microsoft September 2026 Early Security Updates vom 2026-09-03
https://msrc.microsoft.com/update-guide/releaseNote/2026-Sep