Skip to content
OpenAdvisories
High WID-SEC-2026-4487 24 CVEs

Microsoft Azure: Mehrere Schwachstellen

Published Nov 10, 2026 · Updated Nov 10, 2026 · de

Vendor: Microsoft Product: Azure Product: Azure Linux Product: PowerShell Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in verschiedenen Microsoft Azure Produkten ausnutzen, um seine Privilegien zu erhöhen, um Code auszuführen, um Informationen offenzulegen und um Sicherheitsmechanismen zu umgehen.

Product

Azure ist eine Cloud Computing-Plattform von Microsoft.

Vulnerabilities 24

  • Critical 9.8
    CVE-2026-114160

    Azure Managed Grafana Elevation of Privilege Vulnerability

    Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Managed Grafana Web / CMS
  • Critical 9.8
    CVE-2026-119990

    Azure OpenAI Elevation of Privilege Vulnerability

    Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Open AI
  • Critical 9.1
    CVE-2026-114162

    Microsoft Graph Elevation of Privilege Vulnerability

    Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure Privileged Identity Management (PIM)
  • High 8.6
    CVE-2026-118742

    Azure Front Door Elevation of Privilege Vulnerability

    Incorrect permission assignment for critical resource in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Azure Front Door
  • High 8.4
    CVE-2026-102224

    Azure CycleCloud Elevation of Privilege Vulnerability

    Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure CycleCloud 8.9.1
  • High 8.2
    CVE-2026-119989

    Azure Pipelines Remote Code Execution Vulnerability

    Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.

    Microsoft Azure Web Apps
  • High 8.0
    CVE-2026-109457

    Azure CLI Remote Code Execution Vulnerability

    Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network.

    Microsoft Azure Machine Learning
  • High 7.8
    CVE-2026-105494

    Azure NFS mount helper (aznfs) Elevation of Privilege Vulnerability

    Untrusted search path in Azure NFS mount helper (aznfs) allows an authorized attacker to elevate privileges locally.

    Microsoft aznfs
  • High 7.8
    CVE-2026-114161

    Azure CycleCloud Elevation of Privilege Vulnerability

    Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an authorized attacker to elevate privileges locally.

    Microsoft Azure CycleCloud 8.9.2
  • High 7.8
    CVE-2026-122986

    Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

    Improper privilege management in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges locally.

    Microsoft kernel-mshv-6.6.137.mshv2-2.azl3.x86_64
  • High 7.7
    CVE-2026-121668

    Azure Confidential Clean Rooms Tampering Vulnerability

    Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network.

    Microsoft Azure Confidential Clean Room
  • High 7.5
    CVE-2026-113823

    Azure CycleCloud Information Disclosure Vulnerability

    Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an unauthorized attacker to disclose information over a network.

    Microsoft Azure CycleCloud 8.9.2
  • High 7.0
    CVE-2026-105734

    Azure Local Elevation of Privilege Vulnerability

    Incorrect permission assignment for critical resource in Azure Local allows an authorized attacker to elevate privileges locally.

    Microsoft Azure Local
  • High 7.0
    CVE-2026-118288

    Microsoft Azure File Sync Elevation of Privilege Vulnerability

    Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally.

    Microsoft Azure File Sync Azure File Sync v22
  • Medium 6.8
    CVE-2026-108469

    Microsoft Authentication Library for JavaScript Spoofing Vulnerability

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Authentication Library for JavaScript allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Microsoft Authentication Library for JavaScript
  • Medium 6.5
    CVE-2026-108470

    Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability

    Insufficiently protected credentials in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.

    Microsoft @azure/msal-node
  • Medium 6.5
    CVE-2026-113822

    Azure CycleCloud Elevation of Privilege Vulnerability

    Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

    Microsoft Azure CycleCloud 8.9.1
  • Medium 6.1
    CVE-2026-121669

    PowerShell Information Disclosure Vulnerability

    Insufficiently protected credentials in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

    Microsoft PowerShell 7.6 PowerShell 7.7
  • Medium 6.1
    CVE-2026-121674

    PowerShell Information Disclosure Vulnerability

    Insertion of sensitive information into sent data in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

    Microsoft PowerShell 7.6 PowerShell 7.7
  • Medium 6.1
    CVE-2026-121675

    PowerShell Information Disclosure Vulnerability

    Improper restriction of xml external entity reference in Microsoft PowerShell allows an unauthorized attacker to disclose information over a network.

    Microsoft PowerShell 7.6 PowerShell 7.7
  • Medium 6.1
    CVE-2026-122985

    Microsoft PowerShell Information Disclosure Vulnerability

    Improper restriction of xml external entity reference in Microsoft PowerShell allows an unauthorized attacker to disclose information over a network.

    Microsoft PowerShell 7.6 PowerShell 7.7
  • Medium 5.9
    CVE-2026-122987

    Microsoft High Performance Computing (HPC) Pack Elevation of Privilege Vulnerability

    Missing authentication for critical function in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to elevate privileges over a network.

    Microsoft Microsoft HPC Pack 2019 Microsoft HPC Pack 2016
  • Medium 5.5
    CVE-2026-109460

    Microsoft Entra Private Network Connector Information Disclosure Vulnerability

    Exposure of sensitive information to an unauthorized actor in Microsoft Entra Private Network Connector allows an authorized attacker to disclose information locally.

    Microsoft Microsoft Entra Private Network Connector
  • Medium 4.4
    CVE-2026-109462

    Azure Firmware Security Feature Bypass Vulnerability

    Improper check for certificate revocation in Azure Firmware allows an authorized attacker to bypass a security feature locally.

    Microsoft Azure Virtual Machines

Revision history

  1. #1

    Initiale Fassung

References