DeutschShown in its original language — a full translation is planned for a future version.
Microsoft Azure Komponenten: Mehrere Schwachstellen
view advisory published 2026-03-10
Ein Angreifer kann mehrere Schwachstellen in Microsoft Windows Admin Center, Microsoft Azure und Microsoft Azure Linux ausnutzen, um seine Privilegien zu erhöhen, um Informationen offenzulegen, und um falsche Informationen darzustellen.
01
describes (13)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-26148US | — | — | ||
External initialization of trusted variables or data stores in Azure Entra ID allows an unauthorized attacker to elevate privileges locally. | ||||
| CVE-2026-26141US | —OT elevated | — | ||
Improper authentication in Azure Arc allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-26121US | — | — | ||
Server-side request forgery (ssrf) in Azure IoT Explorer allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-26118US | — | Exploit | ||
Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-26117US | —OT elevated | — | ||
Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-23665US | — | — | ||
Heap-based buffer overflow in Azure Linux Virtual Machines allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-23664US | — | — | ||
Improper restriction of communication channel to intended endpoints in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-23662US | —OT elevated | — | ||
Missing authentication for critical function in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-23661US | —OT elevated | — | ||
Cleartext transmission of sensitive information in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-23660US | — | — | ||
Improper access control in Azure Portal Windows Admin Center allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-26124US | — | — | ||
'.../...//' in Azure Compute Gallery allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-26122US | —OT elevated | — | ||
Initialization of a resource with an insecure default in Azure Compute Gallery allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-23651US | — | — | ||
Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally. | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan