PT-2026-102038

Security vulnerability affects the azure-functions-node package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-83946: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' in Azure Portal allows an unauthorized attacker to perform spoofing over a network...

PT-2026-101313

Security vulnerability affects the azure-functions-node package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-102049

Security vulnerability affects the azure-functions-node package. This issue is resolved in later releases. See references for vulnerability details...

CVE-2026-85917

Server-side request forgery ssrf in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-85889

Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-87701

Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network...

CVE-2026-83944

Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-70200

Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-70009

Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-69399

Azure Arc Elevation of Privilege Vulnerability...

CVE-2026-68791

Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network...

CVE-2026-83946

CVE-2026-83946 is a cross-site scripting (XSS) vulnerability in Azure Portal , caused by improper neutralization of input during web page generation. An unauthorized attacker with network access can exploit this to perform spoofing , achieving high confidentiality impact and low integrity impact ...

CVE-2026-62874

Azure Billing is affected by an elevation of privilege vulnerability caused by insufficient verification of data authenticity , allowing an unauthorized attacker to elevate privileges over a network with no prior access or user interaction. The vulnerability is rated CRITICAL (CVSS 3.1: 10.0) wit...

CVE-2026-85878

CVE-2026-85878 is an improper authorization vulnerability in Azure Database for PostgreSQL that allows an authorized attacker to elevate privileges over a network. Microsoft's CNA rates it CVSS 3.1 9.9 (CRITICAL) with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a low-complexity ne...

CVE-2026-85917

A server-side request forgery (SSRF) vulnerability in Azure AI Foundry allows an unauthorized, network-based attacker to elevate privileges. The CVSS 3.1 score is 7.5 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating no privileges required, low complexity, and a high confide...

CVE-2026-70200

Azure Logic Apps is affected by a path traversal vulnerability (improper limitation of a pathname to a restricted directory) that allows an unauthorized attacker to elevate privileges over a network. The CNA-assigned CVSS 3.1 score is 10.0 (Critical) , reflecting a network-based attack with low c...

CVE-2026-85889

Azure AI Foundry is affected by a missing authentication vulnerability in a critical function, allowing an unauthenticated attacker to elevate privileges over a network. The flaw is rated CRITICAL (CVSS 3.1: 10.0) with a vector of network-based, low complexity, no privileges required, no user int...

CVE-2026-87701

Azure Cosmos DB is affected by an injection vulnerability (improper neutralization of special elements in output used by a downstream component) that allows an authorized attacker to elevate privileges over a network . The CVSS 3.1 score is 9.6 (CRITICAL) , with a vector of AV:N/AC:L/PR:L/UI:N/S:...

CVE-2026-83944

CVE-2026-83944 is an improper access control flaw in Azure Logic Apps that allows an unauthorized, remote attacker to elevate privileges over a network with no user interaction and no prior privileges required. The CNA-assigned CVSS 3.1 score is 10.0 (CRITICAL) with a scope change, impacting conf...