DeutschShown in its original language — a full translation is planned for a future version.
Microsoft Clouddienste: Mehrere Schwachstellen ermöglichen Privilegieneskalation
view advisory published 2026-06-04
Ein Angreifer kann mehrere Schwachstellen in verschiedenen Microsoft Clouddiensten wie Azure HorizonDB, Exchange Online, 365 Copilot und dem Copilot Chat in Edge ausnutzen, um seine Privilegien zu erweitern, um beliebigen Code auszuführen und um Informationen offenzulegen.
01
describes (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-48579US | high7.5 | — | ||
Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-48567US | critical9.8 | — | ||
Authentication bypass by spoofing in Azure HorizonDB allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-47655US | — | — | ||
Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-47644US | high7.5 | Exploit | ||
Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose info… | ||||
| CVE-2026-45497US | high8.8 | — | ||
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-42824US | high7.5 | — | ||
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. | ||||
02
references
External citations — patches, advisories, analysis.
- Microsoft Security Advisory CVE-2026-42824 vom 2026-06-04external
- Microsoft Security Advisory CVE-2026-45497 vom 2026-06-04external
- PoC Varonis CVE-2026-42824 vom 2026-06-15external
- Microsoft Security Advisory CVE-2026-47655 vom 2026-06-04external
- Microsoft Security Advisory CVE-2026-48567 vom 2026-06-04external
- Microsoft Security Advisory CVE-2026-48579 vom 2026-06-04external
- WID-SEC-W-2026-1792 - CSAF Versionself
- WID-SEC-2026-1792 - Portal Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan