Microsoft's cloud platform — Entra ID, AKS, Storage, and the broader Azure stack.
Threat actors have been exploiting Microsoft Azure infrastructure to host fake Windows security alerts and phishing pages targeting users at 80 organizations since March 2026. The campaign uses programmatic advertising to distribute malicious landing pages that impersonate Microsoft security warnings and lure users into calling fraudulent support numbers. New pages were appearing daily as of November 2, 2026, and the operation remains active.
Threat campaign 'Key Eater' is actively exploiting stolen Microsoft Entra ID application credentials to infiltrate Azure and Microsoft 365 environments across 27 organizations via managed service providers. Since November 1, 2026, attackers have authenticated into 33 of 45 targeted app registrations, downloaded 81 files, and exfiltrated 2,279 mailbox items including passwords, private keys, VPN profiles, and backup credentials. The operator, identified at 199.19.77.84, uses scripted tooling and adapted signatures after detection on November 3; no Microsoft system vulnerabilities were exploited.
CVE-2026-105769 is a critical vulnerability (CVSS 9.3) in kaniko before version 1.25.20 that allows attackers to exfiltrate Microsoft Entra ID (Azure AD) access tokens for Azure Resource Manager. The flaw stems from an unanchored regex in the Azure Container Registry credential helper that accepts any hostname containing .azurecr.io or related domains; a malicious Dockerfile referencing a lookalike registry (e.g., FROM x.azurecr.io.attacker.com) causes the helper to post credentials to the attacker's endpoint. No public exploitation has been reported. Patched version 1.25.20 is available.
Microsoft disclosed CVE-2026-114148, an elevation of privilege vulnerability in ASP.NET Core affecting .NET 9.0, 10.0, and 11.0 on Linux, macOS, and Windows with CVSS 7.8. Red Hat has released patched versions (9.0.123, 10.0.403, 11.0.100-rc.3). An attacker with low privileges can gain unauthorized elevated privileges. No public exploitation reported.
Microsoft disclosed CVE-2026-83938, a missing-authentication flaw in Azure Kubernetes Configuration Service with CVSS 10.0, on October 22, 2026. The vulnerability allows unauthorized attackers to elevate privileges over a network. Microsoft has fixed the issue on its side; customers require no action. No public exploitation has been reported.
Microsoft released emergency out-of-band security updates for .NET 8, 9, 10, and 11 RC3 on October 26, 2026, addressing CVE-2026-111497 (Brotli buffer overflow) and three additional vulnerabilities. CVE-2026-111497 is a critical out-of-bounds write in Brotli decompression affecting ASP.NET Core and HttpClient; attackers can read/corrupt memory leading to information disclosure, DoS, or privilege escalation. Affected versions prior to .NET 8.0.33, 9.0.22, 10.0.14, and 11 RC3 require immediate patching.
CVE-2026-80097 in Microsoft Authenticator for Android allows malicious apps without permissions to steal authentication tokens by impersonating Microsoft applications and bypassing token broker security checks. Affected versions prior to 6.2606.4246 are vulnerable; tokens can grant unauthorized access to Microsoft Graph, Exchange, SharePoint, and Teams resources. A patch was released and published September 8, 2026.
Microsoft released 1,415 security patches in October 2026 Patch Tuesday, the first four-digit CVE release in company history. The update includes critical vulnerabilities affecting Azure services, SharePoint, SQL Server, Windows, and Exchange. CVE-2026-96951 (Windows Shell) is actively exploited in the wild; CVE-2026-102866 (SharePoint) allows unauthenticated elevation of privilege; CVE-2026-65674 (SQL Server) enables remote code execution. Fifty-nine CVEs are classified as potentially wormable.
ConnectWise Cloud Backup service suffered a supply-chain compromise, allowing hackers to access application identities within the service and breach at least 162 Microsoft 365 tenants. Unauthorized access originated from IP 144.172.64.128 on October 15, 2026. ConnectWise has shut down Cloud Backup access and launched investigation and remediation. Microsoft confirmed malicious activity on October 15.
Microsoft released its largest security update on October 13, 2026, addressing 1,411 vulnerabilities across 176 updates spanning Windows, Office, Exchange, SQL Server, Azure, and other services. The release includes one actively exploited Windows Shell zero-day (CVE-2026-96951) enabling security feature bypass, two publicly disclosed zero-days (.NET Framework CVE-2026-108398 and MessagePack-CSharp CVE-2026-92707), and 70 critical vulnerabilities. Organizations should prioritize patching the Windows Shell flaw first.
Microsoft detected Storm-3168 (JADEPUFFER), a sophisticated threat actor leveraging agentic AI orchestration to exploit compromised Azure service principal credentials. The attackers conducted reconnaissance and executed rapid destructive operations across Azure environments, including deletion of storage accounts, key vaults, SQL databases, and backup/recovery resources. The campaign demonstrates the first documented instance of agentic ransomware operations targeting cloud infrastructure, with attackers successfully exfiltrating credentials and disabling recovery mechanisms across multiple victim organizations.
Microsoft released an out-of-band security update for Exchange Server addressing CVE-2026-96940, a high-severity vulnerability allowing authenticated attackers to read emails and attachments of other users in the same organization. The flaw does not permit cross-tenant access. Microsoft stated it is not aware of active exploitation but notes this type of vulnerability has been exploited in the past. The update is available for Exchange Server Subscription RTM, 2019 CU14-15, and 2016 CU23.
A researcher disclosed a JWT signature verification flaw in Titan, Microsoft's internal analytics service, that allowed bypassing authentication to access employee records and Bing search analytics data. The vulnerability could have exposed approximately 17 trillion rows of data across 17 connected databases. Microsoft locked down the endpoint on September 9, 2026, following coordinated disclosure on September 5.
Microsoft released patches on September 26, 2026 for 18 vulnerabilities affecting Azure and cloud AI products, including privilege escalation flaws in Azure ARC, Azure AI Foundry, Azure Logic Apps, Azure Billing, Azure Cosmos DB, Azure Container Registry, and Microsoft Fabric. Information disclosure vulnerabilities were also corrected in Copilot and Azure Machine Learning. No active exploitation reported; patches deployed server-side requiring no customer action.
A researcher discovered a critical JWT signature validation bypass in Microsoft's internal Titan analytics service hosted on Azure Cloud Services. The flaw allowed forged admin access and unauthenticated SQL queries, potentially exposing approximately 17.3 trillion database rows of metadata including account records, employee emails, database configurations, and analytics dashboards. Microsoft patched the vulnerability on September 9, 2026, after the researcher disclosed it on September 5. No evidence of malicious exploitation was found.
CVE-2026-85889, a CVSS 10.0 missing-authentication vulnerability in Azure AI Foundry, enables unauthenticated privilege escalation over the network with high impact to confidentiality, integrity, and availability. Microsoft patched the flaw server-side on September 18, 2026, as part of a 12-CVE cluster affecting multiple Azure and Microsoft 365 services. The vulnerability affects Azure AI Foundry's control plane, potentially allowing unauthorized access to model deployments, agent management, and AI workload provisioning affecting over 100,000 enterprise customers.
CVE-2026-65660, a critical code-injection vulnerability in Microsoft SharePoint Server 2016, 2019, and Subscription Edition, enables authenticated remote code execution despite being initially misclassified by Microsoft as a spoofing flaw with lower severity. Microsoft patched the flaw on August 11, 2026; full technical exploit details were published September 22, 2026. No in-the-wild exploitation has been reported, though the vulnerability allows attackers to bypass SafeControls restrictions and execute arbitrary code via deserialization.
Microsoft released patches for over 10 critical vulnerabilities across Azure services in September 2026, forming a coordinated cluster affecting identity infrastructure (Entra ID, Azure AD B2C), AI services (AI Language, AI Foundry), data tier (PostgreSQL, Dataverse, Fabric, Cosmos DB), and billing layer. Two newly disclosed CVEs (CVE-2026-85878 in PostgreSQL with CVSS 9.9 and CVE-2026-62874 in Billing with CVSS 10.0) allow unauthenticated attackers to elevate privileges and compromise financial and data integrity. All vulnerabilities stemmed from shared authentication/authorization logic failures allowing bypass of trust boundaries.
CVE-2026-87701, a critical injection vulnerability (CWE-74) in Microsoft Azure Cosmos DB, allows authorized attackers to elevate privileges over a network with a CVSS score of 9.6. The flaw arises from improper neutralization of special elements in output used by downstream components, affecting confidentiality and integrity. Microsoft has released an official patch and manages remediation for the cloud service.
NightEagle (APT-Q-95) has conducted intrusions against Russian organizations using compromised VPN credentials and the GhostContainer backdoor deployed on Microsoft Exchange servers. The group abuses Microsoft Dev Tunnels combined with RDP tunneling to maintain covert access and move laterally through victim networks, targeting Active Directory and exploiting legacy RDP vulnerabilities. Initial access, Exchange compromise, and sustained tunneling through legitimate Microsoft services demonstrate mature tradecraft designed to evade detection.
GhostCode, a device-code phishing kit discovered in late August 2026, exploits Microsoft Entra device enrollment to maintain persistent access after token revocation. Attackers use business-email-compromise social engineering to deliver password-protected HTML lures masquerading as document portals. Upon phishing successful MFA-approved OAuth device-code authentication, operators automatically register rogue Entra devices and obtain Primary Refresh Tokens (PRTs), establishing tenacious footholds that persist even after original stolen tokens are revoked. Infrastructure analysis identified over 30 lookalike domains impersonating U.S. distributors and manufacturers.
Attackers conducted widespread mass-scanning campaigns in August 2026 targeting exposed Vite development servers to steal cloud credentials and Azure tokens via CVE-2026-39364, a file-read bypass (CVSS 7.5) affecting Vite 7.1.0–7.3.2 and 8.0.5. Honeynet telemetry recorded 807 session-grouped attacks and approximately 32,000 raw events. Attackers employed extensive wordlists to extract .env files, AWS/Azure credentials, and infrastructure state data from common paths, enabling potential cloud account compromise.
Microsoft released a record-breaking September 2026 Patch Tuesday on September 8, addressing 973 vulnerabilities across Windows, Office, SQL Server, and related services. Two elevation-of-privilege zero-days are confirmed actively exploited in the wild: CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (Windows Advanced Local Procedure Call). Of the 973 fixes, 113 are rated Critical, including remote-code-execution vulnerabilities in Windows DNS Server and Remote Desktop Services. Organizations should prioritize patching the two exploited flaws within 24 hours.
Microsoft disclosed nine vulnerabilities on September 3, 2026, affecting Azure services including Azure AD B2C, Azure AI Language Authoring, and Entra ID, with two CVEs rated CVSS 10.0. The flaws involve authorization bypasses and authentication failures in identity infrastructure mediating 600 million daily identity attacks. Microsoft applied server-side mitigations in production; no customer patching required but defense-in-depth measures are advised.
CVE-2026-65818, a server-side request forgery (SSRF) vulnerability in Microsoft Power Automate (CVSS 8.5), was published on September 3, 2026. The flaw allows an authorized attacker with low privileges to elevate privileges over a network through SSRF exploitation. Microsoft has released an official fix; organizations should apply the remediation immediately.
CVE-2026-62911, a critical authentication bypass vulnerability in Microsoft Exchange Server disclosed in August 2026, affects over 21,000 unpatched servers globally. The flaw enables NTLM credential relay attacks on the MRSProxy endpoint, allowing unauthenticated attackers to bypass authentication and, when chained with additional vulnerabilities, achieve pre-authentication remote code execution. A public proof-of-concept has been released, and patches are available from Microsoft but adoption remains slow.
Microsoft reversed its exploitation status for CVE-2026-69836, an Entra ID vulnerability, changing from 'under active exploitation' to 'not exploited.' The vulnerability affects Microsoft Azure Entra ID authentication systems.
CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog on August 18, 2026, including CVE-2026-33824 (Windows IKE remote code execution, CVSS 9.8) and CVE-2026-55040 (Microsoft SharePoint authentication bypass, CVSS 9.1). The SharePoint flaw enables unauthenticated attackers to forge authentication tokens and gain administrator access to on-premises SharePoint Server. Rapid7 published a proof-of-concept for CVE-2026-55040 on August 11; exploitation attempts using the PoC were reported within hours. CISA mandated remediation for federal systems by August 21, 2026.
CISA added CVE-2019-1068, a remote code execution vulnerability in Microsoft SQL Server, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw allows attackers to execute code with the privileges of the SQL Server Database Engine service account. CISA mandated remediation by August 29, 2026, and flagged the issue for forensic triage. While the vulnerability dates to 2019, recent exploitation attempts demonstrate ongoing risk to SQL Server instances commonly deployed in Azure environments.
A threat actor using the alias "TheHatman" conducted a large-scale credential-theft campaign targeting Microsoft Azure and Entra ID tenants, exfiltrating millions of corporate employee directory records from major multinational organizations including McDonald's (1.7M+ records), Vodafone (425K+), Tata Consultancy Services (800K+), and others. The stolen data includes display names, employee IDs, corporate emails, user principal names, phone numbers, job titles, department structures, manager relationships, and references to privileged accounts. Attackers obtained access via compromised credentials from infostealer malware, weak authentication, or phishing; the data enables high-precision spear-phishing, business email compromise, and targeted credential harvesting attacks.