Multiple critical vulnerabilities disclosed in Microsoft Azure products including remote code execution and data confidentiality risks
On November 10, 2026, Microsoft released security bulletins addressing multiple critical vulnerabilities affecting a broad range of Microsoft Azure components including Azure Confidential Clean Room, Azure CycleCloud, Azure DevOps, Azure File Sync, Azure Machine Learning, Azure Privileged Identity Management, Azure Virtual Machines, and Azure Web Apps. These vulnerabilities allow attackers to execute arbitrary code remotely, escalate privileges, bypass security policies, and compromise data confidentiality and integrity. Affected versions generally include all releases prior to recent patched versions listed by Microsoft. Administrators are advised to consult the official Microsoft security bulletins to identify impacted versions and apply patches promptly to mitigate these risks.
Entenda a falha
A vulnerabilidade
Microsoft published bulletins on November 10, 2026 for 17 CVEs (CVE-2026-102224, CVE-2026-105734, CVE-2026-108470 and others) across several Azure products. CERT-FR says some of them allow remote code execution, privilege escalation, security policy bypass and loss of data confidentiality and integrity. The articles do not say which CVE maps to which product or impact, nor what access or authentication an attacker needs. Affected versions are: Azure Confidential Clean Room before 11.0.0, Azure CycleCloud before 8.10.1-3968 (8.9.1) or 8.10.1 (8.9.2), Azure DevOps Server before Patch 10, Azure DevOps before Sprint 278, Azure File Sync v21/v22/v23 before 23.2, Azure Local before 1.2610.2.3134, Azure Machine Learning before 2.45.1, Azure Privileged Identity Management before 2.0.32.2053, Azure Virtual Machines before 2610 and Azure Web Apps before 2.10.0. Fixes are in the Microsoft bulletins.
Como foi descoberta
The articles do not say who found these flaws or how. Microsoft disclosed them through its security bulletins on November 10, 2026, and CERT-FR republished them in advisory CERTFR-2026-AVI-1514 on November 12, 2026, saying only that multiple vulnerabilities were discovered in Microsoft Azure.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 13:23.
Linha do tempo
-
Multiple critical vulnerabilities disclosed in Microsoft Azure products including remote code execution and data confidentiality risks
ler a análise desta fonte ocultar
On November 10, 2026, Microsoft released security bulletins addressing multiple critical vulnerabilities affecting a broad range of Microsoft Azure components including Azure Confidential Clean Room, Azure CycleCloud, Azure DevOps, Azure File Sync, Azure Machine Learning, Azure Privileged Identity Management, Azure Virtual Machines, and Azure Web Apps. These vulnerabilities allow attackers to execute arbitrary code remotely, escalate privileges, bypass security policies, and compromise data confidentiality and integrity. Affected versions generally include all releases prior to recent patched versions listed by Microsoft. Administrators are advised to consult the official Microsoft security bulletins to identify impacted versions and apply patches promptly to mitigate these risks.