Month: September 2026

Improper limitation of a pathname to a restricted directory (‘path traversal’) in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network. Continue reading CVE-2026-70200 Azure Logic Apps Elevation of Privilege Vulnerability→

Improper neutralization of special elements in output used by a downstream component (‘injection’) in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network. Continue reading CVE-2026-87701 Azure Cosmos DB Elevation of Privilege Vulnerability→

Improper neutralization of special elements used in a command (‘command injection’) in Microsoft 365 Copilot’s Business Chat allows an unauthorized attacker to disclose information over a network. Continue reading CVE-2026-78501 Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability→

Improper limitation of a pathname to a restricted directory (‘path traversal’) in Azure Arc allows an unauthorized attacker to elevate privileges over a network. Continue reading CVE-2026-70009 Azure Arc Elevation of Privilege Vulnerability→

Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network. Continue reading CVE-2026-69865 Microsoft Container Registry Elevation of Privilege Vulnerability→

Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network. Continue reading CVE-2026-77903 Microsoft Dataverse Elevation of Privilege Vulnerability→

Information published. Continue reading CVE-2026-69399 Azure Arc Elevation of Privilege Vulnerability→

Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network. Continue reading CVE-2026-68791 Azure Machine Learning Information Disclosure Vulnerability→