DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Microsoft Azure, Copilot, Exchange, Surface: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-07-23
Ein Angreifer kann mehrere Schwachstellen in Microsoft Azure, Microsoft 365 Copilot, Microsoft Exchange und Microsoft Apps Surface ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.
01
beschreibt (13)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-58630US | critical9.8 | — | ||
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-57106US | — | — | ||
Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-56163US | —OT erhöht | — | ||
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-62825US | critical9.8 | — | ||
Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-58275US | critical9.8OT erhöht | — | ||
Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-56191US | — | — | ||
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network. | ||||
| CVE-2026-56167US | high8.8 | — | ||
Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-56165US | — | — | ||
Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-56160US | critical9.9 | — | ||
Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-54120US | high8.8 | — | ||
Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-50517US | — | — | ||
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-49159US | — | — | ||
Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-35425US | high7.2 | — | ||
Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network. | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Microsoft Leitfaden für Sicherheitsupdates vom 2026-07-23external
- Microsoft Security Advisory CVE-2026-35425 vom 2026-07-23external
- Microsoft Security Advisory CVE-2026-49159 vom 2026-07-23external
- Microsoft Security Advisory CVE-2026-50517 vom 2026-07-23external
- Microsoft Security Advisory CVE-2026-54120 vom 2026-07-23external
- Microsoft Security Advisory CVE-2026-56160 vom 2026-07-23external
- Microsoft Security Advisory CVE-2026-56163 vom 2026-07-23external
- Microsoft Security Advisory CVE-2026-56165 vom 2026-07-23external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan