Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability

Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

Azure Connected Machine Agent Elevation of Privilege Vulnerability

Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally...

Azure Logic Apps Elevation of Privilege Vulnerability

Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network...

Azure Machine Learning Notebook Spoofing Vulnerability

Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network...

Azure SDK for Java Security Feature Bypass Vulnerability

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may...

Azure Monitor Agent Elevation of Privilege Vulnerability

External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

May 12, 2026—KB5087471 (Monthly Rollup)

None None...

May 12, 2026—KB5087470 (Monthly Rollup)

None None...

KB5089270 - Description of the security update for SQL Server 2016 SP3 Azure Connect Feature Pack: May 12, 2026

None None...

May 12, 2026-Security and Quality Rollup for .NET Framework 3.5 for Windows Server 2012 R2 (KB5087049)

None None...

BIT-ARGO-WORKFLOWS-2026-42295 Argo Workflows: Exposure of artifact repository credentials

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials S3 access keys, secret keys, GCS service account keys, Azure account keys, Gi...

Malicious code in @mistralai/mistralai-azure (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af58e099ab615b8869cb741b5604f6becdf1e9d1d7c5ac326f9c4065f5f590f6 The package @mistralai/mistralai-azure was found to contain malicious code. Source: ghsa-malware...

PT-2026-40255

Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

PT-2026-40135

Name of the Vulnerable Software and Affected Versions Azure Monitor Agent versions prior to May 2026 Description External control of a file name or path allows an authorized attacker to elevate privileges locally. Recommendations Update to the May 2026 patch...

automated deployment and scaling Code Execution

The vulnerability of the automated deployment and scaling service for managed Apache Cassandra instances is related to access control errors. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

KB5087545: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (May 2026)

The remote Windows host is missing security update 5087545 or hotpatch 5087424. It is, therefore, affected by multiple vulnerabilities - Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network. CVE-2026-41089 - Use after free in Windows Hyper...

PT-2026-40139

Name of the Vulnerable Software and Affected Versions Azure SDK for Java affected versions not specified Description Improper authentication in the Azure SDK for Java allows an unauthorized attacker to bypass a security feature over a network. Recommendations At the moment, there is no informatio...

PT-2026-40141

Name of the Vulnerable Software and Affected Versions Azure Machine Learning affected versions not specified Description Improper neutralization of special elements in output used by a downstream component allows an unauthorized attacker to perform spoofing over a network. This issue can lead to...

CVE-2026-32204: External Control of File Name or Path

External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

CVE-2026-40379: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network...