Skip to content
OpenAdvisories
High WID-SEC-2026-4286 7 CVEs

Microsoft Azure, Entra und Exchange: Mehrere Schwachstellen

Published Nov 1, 2026 · Updated Nov 1, 2026 · de-DE

Vendor: Microsoft Product: Azure Product: Entra Product: Exchange Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Microsoft Azure, Microsoft Entra und Microsoft Exchange ausnutzen, um seine Privilegien zu erhöhen oder beliebigen Code auszuführen.

Product

Azure ist eine Cloud Computing-Plattform von Microsoft.
Microsoft Entra ID (früher Azure Active Directory) ist ein cloudbasierter Identitäts- und Zugriffsverwaltungsdienst von Microsoft.
Exchange ist ein Groupware und Nachrichtensystem der Firma Microsoft.

Vulnerabilities 7

  • Critical 10.0
    CVE-2026-110063

    VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability

    Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.

    Microsoft VM Inspector for Azure Virtual Machines
  • Critical 10.0
    CVE-2026-69843

    Microsoft Fabric Elevation of Privilege Vulnerability

    Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Microsoft Fabric
  • Critical 10.0
    CVE-2026-83938

    Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability

    Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Kubernetes Configuration Service
  • Critical 10.0
    CVE-2026-97785

    AAD App Proxy Elevation of Privilege Vulnerability

    Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Microsoft Entra application proxy
  • Critical 9.1
    CVE-2026-105014

    Azure Pipelines Remote Code Execution Vulnerability

    Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.

    Microsoft Azure Pipelines
  • High 7.7
    CVE-2026-108456

    Azure AI Foundry Elevation of Privilege Vulnerability

    Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure AI Foundry
  • High 7.5
    CVE-2026-96185

    Microsoft Exchange Online Remote Code Execution Vulnerability

    Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.

    Microsoft Microsoft Exchange Online

Revision history

  1. #1

    Initiale Fassung

References