Skip to content
OpenAdvisories
High WID-SEC-2026-3460 12 CVEs

Microsoft Azure: Mehrere Schwachstellen

Published Sep 17, 2026 · Updated Sep 17, 2026 · de-DE

Vendor: Microsoft Product: Azure Product: Azure CLI Product: Azure Cosmos DB Product: Entra Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Microsoft Azure, Microsoft Azure Cosmos DB, Microsoft Entra und Microsoft Azure CLI ausnutzen, um seine Privilegien zu erhöhen, um falsche Informationen darzustellen, um Informationen offenzulegen und um beliebigen Programmcode auszuführen.

Product

Azure ist eine Cloud Computing-Plattform von Microsoft.
Azure Cosmos DB ist ein NoSQL-Datenbankdienst von Microsoft.
Microsoft Entra ID (früher Azure Active Directory) ist ein cloudbasierter Identitäts- und Zugriffsverwaltungsdienst von Microsoft.
Die Azure-Befehlszeilenschnittstelle (Command-Line Interface, CLI) setzt sich aus Befehlen zum Erstellen und Verwalten von Azure-Ressourcen zusammen. Die Azure CLI ist in allen Azure-Diensten verfügbar.

Vulnerabilities 12

  • Critical 10.0
    CVE-2026-62874

    Azure Billing Elevation of Privilege Vulnerability

    Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Billing
  • Critical 10.0
    CVE-2026-69865

    Microsoft Container Registry Elevation of Privilege Vulnerability

    Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Container Registry
  • Critical 10.0
    CVE-2026-70200

    Azure Logic Apps Elevation of Privilege Vulnerability

    Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Logic Apps
  • Critical 10.0
    CVE-2026-83944

    Azure Logic Apps Elevation of Privilege Vulnerability

    Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Logic Apps
  • Critical 10.0
    CVE-2026-85889

    Azure AI Foundry Elevation of Privilege Vulnerability

    Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure AI Foundry
  • Critical 9.9
    CVE-2026-69399

    Azure Arc Elevation of Privilege Vulnerability

    Unintended proxy or intermediary in Azure Arc allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure ARC
  • Critical 9.9
    CVE-2026-85878

    Azure Database for PostgreSQL Elevation of Privilege Vulnerability

    Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure HorizonDB
  • Critical 9.6
    CVE-2026-87701

    Azure Cosmos DB Elevation of Privilege Vulnerability

    Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure Cosmos DB
  • Critical 9.3
    CVE-2026-70009

    Azure Arc Elevation of Privilege Vulnerability

    Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure ARC
  • High 8.6
    CVE-2026-68791

    Azure Machine Learning Information Disclosure Vulnerability

    Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.

    Microsoft Azure Machine Learning
  • High 8.2
    CVE-2026-83946

    Azure Portal Spoofing Vulnerability

    Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Azure Portal
  • High 7.5
    CVE-2026-85917

    Azure AI Foundry Elevation of Privilege Vulnerability

    Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure AI Foundry

Revision history

  1. #1

    Initiale Fassung

References