CVE-2026-26137

CVE-2026-26137 is described as a server-side request forgery (SSRF) that affects Microsoft Exchange (and related Microsoft 365 Copilot/Business Chat contexts in linked sources). The available documents state that an authorized attacker can elevate privileges over a network, with the CVSS 3.1 scor...

CVE-2026-23658 Azure DevOps: msazure Elevation of Privilege Vulnerability

...

CVE-2026-23658

CVE-2026-23658 affects Microsoft Azure DevOps: msazure, with root cause described as insufficiently protected credentials enabling an unauthorized network-based privilege escalation. The description and multiple connected sources confirm impact to Azure DevOps components and privilege elevation, ...

CVE-2026-23658 Azure DevOps: msazure Elevation of Privilege Vulnerability

...

CVE-2026-26138

CVE-2026-26138 describes a server-side request forgery (SSRF) in Microsoft Purview that enables an attacker to achieve a network-based privilege elevation. The connected sources confirm the vulnerable product (Microsoft Purview) and the impact (privilege escalation) via SSRF, but do not provide g...

CVE-2026-26138 Microsoft Purview Elevation of Privilege Vulnerability

...

CVE-2026-26139

Microsoft Purview contains a server-side request forgery (SSRF) vulnerability that could allow a network-based attacker to elevate privileges within the target environment. Affected component: Microsoft Purview; root cause: SSRF leading to privilege elevation. Impact per CVSS: Confidentiality Hig...

CVE-2026-26139 Microsoft Purview Elevation of Privilege Vulnerability

...

CVE-2026-26138 Microsoft Purview Elevation of Privilege Vulnerability

...

CVE-2026-26139 Microsoft Purview Elevation of Privilege Vulnerability

...

CVE-2026-32169 Azure Cloud Shell Elevation of Privilege Vulnerability

...

CVE-2026-32169 Azure Cloud Shell Elevation of Privilege Vulnerability

...

CVE-2026-32169

Azure Cloud Shell contains a server-side request forgery (SSRF) vulnerability (CVE-2026-32169) that could allow an unauthenticated attacker to elevate privileges over a network. The CVSS v3.1 base score is 10.0 (CRITICAL) with network attack vector, low complexity, no privileges required, no user...

Azure DevOps: msazure Elevation of Privilege Vulnerability

Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network...

Microsoft Exchange Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Microsoft Exchange allows an authorized attacker to elevate privileges over a network...

PT-2026-26356

Name of the Vulnerable Software and Affected Versions Microsoft Purview affected versions not specified Description Server-side request forgery ssrf exists in Microsoft Purview, potentially allowing an unauthorized attacker to elevate privileges over a network. SSRF occurs when a server processes...

KLA90945 PE vulnerability in Microsoft Server Software

An elevation of privilege vulnerability was found in Microsoft Server Software. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2026-26137 Exploitation CVE list CVE-2026-26137 critical KB list Solution Install necessary updates from the KB section, that...

Craft CMS Vulnerable to Stored XSS in Revision Context Menu

The revision/draft context menu in the element editor renders the creator’s fullName as raw HTML due to the use of Template::raw combined with Craft::t string interpolation. A low-privileged control panel user e.g., Author can set their fullName to an XSS payload via the profile editor, then crea...

CVE-2026-3564 ScreenConnect Instance Level Cryptographic Material Exposure

A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest client agents are not independently...

CVE-2026-23862

CVE-2026-23862 affects Dell ThinOS 10 versions prior to ThinOS 2602_10.0573. The vulnerability is an Improper Neutralization of Special Elements in a Command (command injection) that could be exploited by a low-privileged local attacker to achieve Elevation of Privileges. The impact is high for c...