Microsoft: Six Critical Azure & Exchange Vulnerabilities Disclosed Together
Microsoft disclosed six critical and high-severity vulnerabilities across Azure services and Exchange Online on October 22, 2026, enabling privilege escalation and code execution.
Key findings
- Six vulnerabilities disclosed simultaneously by Microsoft on October 22, 2026, affecting Azure services and Exchange Online.
- Three critical vulnerabilities (CVSS 10.0) allow privilege escalation via improper authentication or missing authentication.
- Critical command injection (CVE-2026-105014) and high-severity buffer overflow (CVE-2026-96185) allow for code execution.
- Affected services include Azure App Proxy, Kubernetes Configuration Service, VM Inspector, AI Foundry, Azure Pipelines, and Exchange Online.
- All vulnerabilities are network-exploitable, enabling remote attackers to compromise systems.
On October 22, 2026, Microsoft disclosed a batch of six vulnerabilities affecting various Azure services and Microsoft Exchange Online. The disclosures, all occurring within a few minutes of each other, highlight critical security weaknesses that could allow unauthorized attackers to elevate privileges or execute code over a network. The vulnerabilities span several product areas, including Azure App Proxy, Azure Kubernetes Configuration Service, Azure Virtual Machines, Azure AI Foundry, and Microsoft Exchange Online.
Several of the disclosed vulnerabilities are rated as Critical, with CVSSv3 scores reaching 10.0. These include CVE-2026-97785, an improper authentication flaw in AAD App Proxy; CVE-2026-83938, a missing authentication vulnerability in Azure Kubernetes Configuration Service; and CVE-2026-110063, an improper link resolution issue in VM Inspector for Azure Virtual Machines. All three allow for privilege escalation over a network.
Further compounding the risk, CVE-2026-105014, a critical command injection vulnerability in Azure Pipelines, also carries a CVSSv3 score of 9.1 and allows for code execution. Two high-severity vulnerabilities were also part of this batch: CVE-2026-96185, a stack-based buffer overflow in Microsoft Exchange Online enabling code execution, and CVE-2026-108456, a server-side request forgery (SSRF) in Azure AI Foundry, both exploitable over a network.
The clustered nature of these disclosures suggests a coordinated release by Microsoft, likely as part of its regular security update cycle. While the provided information does not detail specific threat actors or in-the-wild exploitation, the severity and network-exploitability of these flaws warrant immediate attention from administrators of affected Microsoft services.
Microsoft has released patches and advisories for these vulnerabilities. Users are strongly recommended to review the specific advisories for each CVE and apply the necessary updates to mitigate the risks of privilege escalation and code execution. Prompt patching is crucial to protect against potential exploitation.
This batch of vulnerabilities underscores the importance of continuous security monitoring and timely patching for cloud environments. Organizations relying on Azure services and Microsoft Exchange Online should prioritize the review and remediation of these issues to maintain a strong security posture. The simultaneous release of these critical and high-severity flaws emphasizes the need for vigilance in managing cloud infrastructure security.