VYPR
patchPublished Aug 20, 2026· Updated Aug 21, 2026· 1 source

Microsoft: 25 Vulnerabilities Disclosed, Including Exploited Entra ID Flaw

Key findings • Microsoft patched 25 vulnerabilities between August 17-20, 2026, impacting Azure, Microsoft 365, and Windows. • Critical vulnerabilities include SSRF, deserialization of untrus…

Key findings

  • Microsoft patched 25 vulnerabilities between August 17-20, 2026, impacting Azure, Microsoft 365, and Windows.
  • Critical vulnerabilities include SSRF, deserialization of untrusted data, and elevation of privilege flaws.
  • CVE-2026-69836, a critical RCE vulnerability in Microsoft Entra ID, was exploited in the wild.
  • CVE-2026-24301, a command injection flaw in Microsoft Copilot nicknamed 'CoSnitch', allows data exfiltration.
  • Multiple critical SQL injection and path traversal vulnerabilities were disclosed in Azure SQL Database and Microsoft Fabric.
  • Patches are available for all disclosed vulnerabilities.

On August 20, 2026, Microsoft disclosed a significant batch of 25 vulnerabilities affecting a wide range of its products, including Azure, Microsoft 365, and Windows. The disclosures, spanning from August 17 to August 20, 2026, include several critical and high-severity flaws, with a notable focus on Server-Side Request Forgery (SSRF) and elevation of privilege (EoP) vulnerabilities. The most severe of these, CVE-2026-69836, a critical deserialization of untrusted data vulnerability in Microsoft Entra ID, was reportedly exploited in the wild prior to patching.

Several critical vulnerabilities were disclosed, including multiple SSRF flaws. CVE-2026-69851, a critical SSRF vulnerability in Azure Active Directory (now Entra ID), allows for privilege escalation. Similarly, CVE-2026-69555, an incorrect authorization flaw in Azure Arc, and CVE-2026-65816, a use of incorrectly-resolved name or reference in Azure Arc, also carry critical severity and allow for privilege escalation. Another critical SSRF vulnerability, CVE-2026-65801, was found in Microsoft Exchange Online.

Elevation of privilege remains a significant theme across the batch. Critical vulnerabilities such as CVE-2026-69400 (path traversal in Azure Logic Apps), CVE-2026-68789 and CVE-2026-68782 (SQL injection in Azure SQL Database), CVE-2026-66309 (improper access control in Azure SQL Database), and CVE-2026-63509 (relative path traversal in Microsoft Fabric) all allow attackers to gain elevated privileges. CVE-2026-65770, an argument injection flaw in Azure Managed Instance for Apache Cassandra, also enables remote code execution.

Beyond SSRF and privilege escalation, other notable vulnerabilities include CVE-2026-69836, a critical deserialization of untrusted data vulnerability in Microsoft Entra ID that allows for remote code execution and was actively exploited in the wild. This vulnerability, along with others like CVE-2026-24301 (command injection in Microsoft Copilot, nicknamed 'CoSnitch'), highlights the diverse attack vectors Microsoft products are facing. CVE-2026-24301, in particular, was reported to allow data exfiltration with a single click.

The batch also includes vulnerabilities in less commonly highlighted areas, such as CVE-2026-70105 (improper input validation in Microsoft Office Word) and CVE-2026-55015 (uncontrolled search path element in Windows Remote Help), which have medium severity. CVE-2026-73851, a vulnerability in the Kiota OpenAPI code generator, allows for file tampering via manipulated OpenAPI descriptions.

Microsoft has released patches for all disclosed vulnerabilities. Users are strongly advised to review the security advisories and apply updates promptly to mitigate the risks associated with these flaws, particularly those that have been exploited in the wild or carry critical severity ratings. The widespread impact across Azure, Entra ID, Microsoft 365, and Windows underscores the importance of continuous security vigilance for Microsoft product users.

Key Findings

  • Microsoft patched 25 vulnerabilities between August 17-20, 2026, impacting Azure, Microsoft 365, and Windows.
  • Critical vulnerabilities include SSRF, deserialization of untrusted data, and elevation of privilege flaws.
  • CVE-2026-69836, a critical RCE vulnerability in Microsoft Entra ID, was exploited in the wild.
  • CVE-2026-24301, a command injection flaw in Microsoft Copilot nicknamed 'CoSnitch', allows data exfiltration.
  • Multiple critical SQL injection and path traversal vulnerabilities were disclosed in Azure SQL Database and Microsoft Fabric.
  • Patches are available for all disclosed vulnerabilities.

CVEs

CVE-2026-70105, CVE-2026-69855, CVE-2026-69851, CVE-2026-69836, CVE-2026-69558, CVE-2026-69555, CVE-2026-69543, CVE-2026-69519, CVE-2026-69419, CVE-2026-69400, CVE-2026-68789, CVE-2026-68782, CVE-2026-66800, CVE-2026-66309, CVE-2026-65816, CVE-2026-65801, CVE-2026-65770, CVE-2026-63509, CVE-2026-62834, CVE-2026-55015, CVE-2026-55013, CVE-2026-69550, CVE-2026-62727, CVE-2026-24301, CVE-2026-73851

Synthesized by Vypr AI