// Microsoft AzureCRITICAL
Microsoft released patches for over 10 critical vulnerabilities across Azure services in September 2026, forming a coordinated cluster affecting identity infrastructure (Entra ID, Azure AD B2C), AI services (AI Language, AI Foundry), data tier (PostgreSQL, Dataverse, Fabric, Cosmos DB), and billing layer. Two newly disclosed CVEs (CVE-2026-85878 in PostgreSQL with CVSS 9.9 and CVE-2026-62874 in Billing with CVSS 10.0) allow unauthenticated attackers to elevate privileges and compromise financial and data integrity. All vulnerabilities stemmed from shared authentication/authorization logic failures allowing bypass of trust boundaries.
- Microsoft Patches 18 Vulnerabilities in AI, Cloud Products - Sec(opens in a new tab)
- The Fault Line Spreads: Azure’s September CVE Cluster Now Covers(opens in a new tab)
- CVE-2026-85889: CWE-306: Missing Authentication for Critical Fun(opens in a new tab)
- Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unaut(opens in a new tab)
- Microsoft Patches 18 Azure and Copilot Security Vulnerabilities(opens in a new tab)
- Critical Microsoft Azure AI Foundry Vulnerability Allows Attacke(opens in a new tab)
// Get alerts for Microsoft Azure