Azure security advisories
60 threat alerts tracking vulnerabilities and security advisories that affect Azure products.
Vulnios monitors Azure CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent Azure security news in one place, or click into an individual alert for full detail.
CVE-2026-121668 Azure Confidential Clean Rooms Tampering Vulnerability
Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network.
criticalCVE-2026-121668CVE-2026-120783 Azure DevOps Server Elevation of Privilege Vulnerability
Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-120783CVE-2026-112745 Azure DevOps Server Information Disclosure Vulnerability
Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to disclose information over a network.
criticalCVE-2026-112745CVE-2026-118742 Azure Front Door Elevation of Privilege Vulnerability
Incorrect permission assignment for critical resource in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-118742CVE-2026-114161 Azure CycleCloud Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an authorized attacker to elevate privileges locally.
criticalCVE-2026-114161CVE-2026-114160 Azure Managed Grafana Elevation of Privilege Vulnerability
No cwe for this issue in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-114160CVE-2026-119989 Azure Pipelines Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.
criticalCVE-2026-119989CVE-2026-105494 Azure NFS mount helper (aznfs) Elevation of Privilege Vulnerability
Untrusted search path in Azure NFS mount helper (aznfs) allows an authorized attacker to elevate privileges locally.
criticalCVE-2026-105494CVE-2026-109462 Azure Firmware Security Feature Bypass Vulnerability
Improper check for certificate revocation in Azure Firmware allows an authorized attacker to bypass a security feature locally.
criticalCVE-2026-109462CVE-2026-85923 Azure DevOps Server Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-85923CVE-2026-105734 Azure Local Elevation of Privilege Vulnerability
Incorrect permission assignment for critical resource in Azure Local allows an authorized attacker to elevate privileges locally.
criticalCVE-2026-105734CVE-2026-109467 Azure DevOps Server Remote Code Execution Vulnerability
Improper authentication in Azure DevOps allows an authorized attacker to execute code over a network.
criticalCVE-2026-109467CVE-2026-113823 Azure CycleCloud Information Disclosure Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an unauthorized attacker to disclose information over a network.
criticalCVE-2026-113823CVE-2026-113822 Azure CycleCloud Elevation of Privilege Vulnerability
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-113822CVE-2026-109457 Azure CLI Remote Code Execution Vulnerability
Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network.
criticalCVE-2026-109457CVE-2026-102224 Azure CycleCloud Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-102224CVE-2026-105014 Azure Pipelines Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
criticalCVE-2026-105014CVE-2026-110063 VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-110063CVE-2026-108456 Azure AI Foundry Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-108456CVE-2026-88094 Azure Storage Library Elevation of Privilege Vulnerability
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-88094CVE-2026-85925 Azure Key Vault Client SDK Elevation of Privilege Vulnerability
Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-85925CVE-2026-85922 Azure Key Vault Security Feature Bypass Vulnerability
Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.
criticalCVE-2026-85922CVE-2026-100207 Azure CycleCloud Remote Code Execution Vulnerability
Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.
criticalCVE-2026-100207CVE-2026-96204 Azure Arc Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-96204CVE-2026-69877 Azure DevOps Information Disclosure Vulnerability
Origin validation error in Azure DevOps allows an unauthorized attacker to disclose information over a network.
criticalCVE-2026-69877CVE-2026-85891 Azure HDInsight Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network.
criticalCVE-2026-85891CVE-2026-85916 Azure Active Directory Information Disclosure Vulnerability
Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.
criticalCVE-2026-85916CVE-2026-88132 Azure Key Vault Information Disclosure Vulnerability
Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network.
criticalCVE-2026-88132CVE-2026-69435 Azure SRE Agent Elevation of Privilege Vulnerability
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-69435CVE-2026-83947 Azure Event Grid Spoofing Vulnerability
Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.
criticalCVE-2026-83947CVE-2026-77900 Azure App Service Remote Code Execution Vulnerability
Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.
criticalCVE-2026-77900CVE-2026-83943 Azure API Center Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network.
criticalCVE-2026-83943JadePuffer agentic AI attacks target Azure, destroy cloud resources
BleepingComputer published an news on "JadePuffer agentic AI attacks target Azure, destroy cloud resources". Topic areas: ransomware, malware, data-breach, zero-day. Published September 28, 2026. See
criticalJADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources
The Hacker News published an news on "JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources". Topic areas: zero-day, malware, ransomware, data-breach. Published Sep
criticalCVE-2026-70200 Azure Logic Apps Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-70200CVE-2026-85889 Azure AI Foundry Elevation of Privilege Vulnerability
Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-85889CVE-2026-85878 Azure Database for PostgreSQL Elevation of Privilege Vulnerability
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-85878CVE-2026-62874 Azure Billing Elevation of Privilege Vulnerability
Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-62874CVE-2026-83944 Azure Logic Apps Elevation of Privilege Vulnerability
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-83944CVE-2026-69399 Azure Arc Elevation of Privilege Vulnerability
Microsoft Security Response Center published an advisory on "CVE-2026-69399 Azure Arc Elevation of Privilege Vulnerability". Topic areas: microsoft, windows, azure, patch. Published September 17, 2026
criticalCVE-2026-69399CVE-2026-85917 Azure AI Foundry Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-85917CVE-2026-68791 Azure Machine Learning Information Disclosure Vulnerability
Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.
criticalCVE-2026-68791CVE-2026-83946 Azure Portal Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network.
criticalCVE-2026-83946CVE-2026-70009 Azure Arc Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-70009CVE-2026-87701 Azure Cosmos DB Elevation of Privilege Vulnerability
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-87701CVE-2026-69854 Spring Cloud Azure Elevation of Privilege Vulnerability
Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-69854CVE-2026-81349 Azure HDInsight Ambari Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an os command ('os command injection') in Azure HDInsights allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-81349CVE-2026-62895 Azure Arc SQL Server Extension Elevation of Privilege Vulnerability
Permissive cross-domain policy with untrusted domains in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-62895CVE-2026-77909 Azure CycleCloud Information Disclosure Vulnerability
Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network.
criticalCVE-2026-77909CVE-2026-69857 Azure Cosmos DB Spoofing Vulnerability
Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network.
criticalCVE-2026-69857CVE-2026-70352 Azure AI Language Elevation of Privilege Vulnerability
Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-70352CVE-2026-62836 Azure SQL Managed Instance Elevation of Privilege Vulnerability
Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-62836CVE-2026-50481 Azure Active Directory Elevation of Privilege Vulnerability
Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-50481CVE-2026-65806 Azure CycleCloud Information Disclosure Vulnerability
Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network.
criticalCVE-2026-65806CVE-2026-57104 Azure Storage Explorer Elevation of Privilege Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-57104CVE-2026-70340 Azure CycleCloud Elevation of Privilege Vulnerability
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-70340CVE-2026-47299 Azure Monitor Agent Elevation of Privilege Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-47299CVE-2026-58275 Azure DNS Elevation of Privilege Vulnerability
Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-58275CVE-2026-35425 Azure API Management (APIM) Remote Code Execution Vulnerability
Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.
criticalCVE-2026-35425CVE-2026-58630 Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-58630
Showing the 60 most recent. Older alerts are archived but still reachable via search and the main feed.
Track Azure exposure across your environment
Vulnios automatically cross-references your asset inventory against new Azure CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan