CVE-2026-47632: Improper Certificate Validation

Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network...

PT-2026-58132

Name of the Vulnerable Software and Affected Versions Azure Monitor Agent affected versions not specified Description Improper certificate validation allows an unauthorized attacker to elevate privileges over an adjacent network. Recommendations At the moment, there is no information about a newe...

CVE-2026-50652: Deserialization of Untrusted Data

Deserialization of untrusted data in Azure Active Directory allows an unauthorized attacker to deny service over a network...

CVE-2026-58279: Missing Authorization

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network...

CVE-2026-50338: Improper Authentication

Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network...

PT-2026-58197

Name of the Vulnerable Software and Affected Versions Azure Spring Apps affected versions not specified Description Improper authentication allows an authorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version that contain...

Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-50722)

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-50722 advisory. - Libreswan, via the function RSAauthenticatehashsignaturepkcs115rsa, did not correctly verify t...

Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-59890)

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-59890 advisory. - setuptools is a package that allows users to download, build, install, upgrade, and uninstall...

Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-14461)

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-14461 advisory. - mtr is vulnerable to Out-of-bound read vulnerability in ipinfolookup function. An attacker who...

KB5099540: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (July 2026)

The remote Windows host is missing security update 5099540. It is, therefore, affected by multiple vulnerabilities - Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a network. CVE-2026-58594 - Heap-based buffer overflow in Windows FTP Service...

KLA91142 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, gain privileges. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure Monitor Agent Metri...

Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-50721)

The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-50721 advisory. - Libreswan, via the function RSAauthenticatehashsignaturerawrsa, did not correctly verify the...

PYSEC-2026-2344 Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access

The accesskey and connectionstring connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could see the values in Connection UI, as well as when Connection was accidently logged to logs, those values could be seen in the logs. Azure...

Apache Airlfow: Sensitive Azure Service Bus connection string (and possibly other providers) exposed to users with view access

The accesskey and connectionstring connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could see the values in Connection UI, as well as when Connection was accidently logged to logs, those values could be seen in the logs. Azure...

PYSEC-2026-2327 Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries

Summary adx-mcp-server ListDictstr, Any: client = getkustoclient query = f"tablename | getschema" ListDictstr, Any: client = getkustoclient query = f"tablename | sample samplesize" ListDictstr, Any: client = getkustoclient query = f".show table tablename details" -- KQL injection resultset =...

Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network

Server-Side Request Forgery SSRF in Azure MCP Server allows an authorized attacker to elevate privileges over a network...

PYSEC-2026-2669 Azure MCP Server has Server-Side Request Forgery issue that allows authorized attacker to elevate privileges over a network

Server-Side Request Forgery SSRF in Azure MCP Server allows an authorized attacker to elevate privileges over a network...

PYSEC-2026-2968 Azure PromptFlow remote code execution related to Jinja templates

Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network...

Azure PromptFlow remote code execution related to Jinja templates

Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network...

CLEANSTART-2026-EY91394 Security fixes for CVE-2026-25679, CVE-2026-27140, CVE-2026-32280, CVE-2026-32281, CVE-2026-32283, CVE-2026-32289 applied in versions: 1.13.2-r0, 1.13.2-r1

Multiple security vulnerabilities affect the velero-plugin-for-microsoft-azure-fips package. These issues are resolved in later releases. See references for individual vulnerability details...