CVE-2026-56160

Technical details (affected products, components, versions, impact, remediation) are not publicly provided in the supplied documents. Monitor for updates from official advisories and vendors.

CVE-2026-56160 Azure Red Hat OpenShift (ARO) Elevation of Privilege Vulnerability

...

CVE-2026-56167 Azure AI Search Elevation of Privilege Vulnerability

...

CVE-2026-56167

Server-side request forgery ssrf in Azure AI Search allows an authorized attacker to elevate privileges over a network...

CVE-2026-56167

Technical details about CVE-2026-56167 are not publicly provided in the connected documents. Monitor for updates from Microsoft/MSRC and CVE databases for affected products, vulnerable components, versions, and remediation.

CVE-2026-56167 Azure AI Search Elevation of Privilege Vulnerability

...

Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...

Azure AI Search Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Azure AI Search allows an authorized attacker to elevate privileges over a network...

Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability

Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network...

Azure API Management (APIM) Remote Code Execution Vulnerability

Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...

Azure Key Vault Elevation of Privilege Vulnerability

Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network...

Azure DNS Elevation of Privilege Vulnerability

Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network...

Azure Red Hat OpenShift (ARO) Elevation of Privilege Vulnerability

Improper authorization in Azure Red Hat OpenShift ARO allows an authorized attacker to elevate privileges over a network...

PT-2026-64205

Name of the Vulnerable Software and Affected Versions Azure Red Hat OpenShift ARO affected versions not specified Description Improper authorization allows an authorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version tha...

PT-2026-64207

Server-side request forgery ssrf in Azure AI Search allows an authorized attacker to elevate privileges over a network...

KLA91175 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability i...

Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents

A single invisible comment in an Azure DevOps pull request can turn a reviewer's own AI coding agent against them, driving it into projects the attacker has no rights to reach and quietly leaking what it finds. The flaw is in Microsoft's official Azure DevOps MCP server, and it works because one ...

EUVD-2025-210492

In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...

CVE-2025-66390

In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...

CVE-2025-66390

CVE-2025-66390 affects Microsoft Azure API Management Developer Portal: when Basic Authentication signup is enabled in Tenant A, an attacker can register on Tenant B by altering the Host header, bypassing a UI-level signup disable because the underlying /signup API remains accessible and validate...