Azure vulnerabilities and fixes

CVEs that mention Azure, ranked by priority. 38 tracked.

Azure has 38 tracked vulnerabilities, 18 critical. A fixed release or vendor patch exists for 35. Most recent: 2026-10-23. Highest priority: CVE-2026-110063 (score 63/100).

• CVE-2026-110063 CRITICAL 10.0 Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allo
• CVE-2026-56162 CRITICAL 10.0 MITIGATE Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a net
• CVE-2026-56163 CRITICAL 10.0 MITIGATE Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized atta
• CVE-2026-58275 CRITICAL 10.0 MITIGATE Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-58630 CRITICAL 10.0 MITIGATE Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a netw
• CVE-2026-62825 CRITICAL 10.0 MITIGATE Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a networ
• CVE-2026-66803 CRITICAL 10.0 MITIGATE Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
• CVE-2026-50516 CRITICAL 9.4 MITIGATE Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privile
• CVE-2026-59243 CRITICAL 9.8 UPGRADE The FAB auth manager's Azure AD OAuth login defaulted `verify_signature=False` when decoding the ID token, so
• CVE-2026-50515 CRITICAL 9.9 MITIGATE Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a ne
• CVE-2026-105014 CRITICAL 9.1 Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows
• CVE-2026-62835 CRITICAL 9.3 MITIGATE Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.
• CVE-2026-83938 CRITICAL 10.0 Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized
• CVE-2026-50481 CRITICAL 9.9 MITIGATE Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to eleva
• CVE-2026-62830 CRITICAL 9.9 MITIGATE Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
• CVE-2026-62836 HIGH 8.7 MITIGATE Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an un
• CVE-2026-56161 CRITICAL 9.6 MITIGATE Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a netwo
• CVE-2026-68823 CRITICAL 9.1 MITIGATE Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute cod
• CVE-2026-56160 CRITICAL 9.1 MITIGATE Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges ov
• CVE-2026-73298 HIGH 8.7 The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-ag
• CVE-2026-57104 HIGH 8.8 UPGRADE Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer
• CVE-2026-70340 HIGH 8.1 UPGRADE Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
• CVE-2026-35425 HIGH 8.0 MITIGATE Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a ne
• CVE-2026-47299 HIGH 7.2 UPGRADE Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent all
• CVE-2026-56167 HIGH 8.5 MITIGATE Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over
• CVE-2026-108456 HIGH 7.7 Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges ove
• CVE-2026-62869 HIGH 8.8 MITIGATE Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoo
• CVE-2026-65806 MEDIUM 6.5 UPGRADE Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network
• CVE-2026-114123 HIGH 7.5 D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code
• CVE-2026-63120 HIGH 8.4 pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores
• CVE-2023-22648 HIGH 8.0 UPGRADE A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be
• CVE-2026-63522 HIGH 7.8 MITIGATE Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to e
• CVE-2026-68870 MEDIUM 5.3 The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connec
• CVE-2026-114655 MEDIUM 5.9 libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values fro
• CVE-2026-106462 MEDIUM 6.4 UPGRADE UPGRADE Backstage is an open framework for building developer portals
• CVE-2026-18348 MEDIUM 4.1 Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticat
• CVE-2026-21811 LOW 3.8 HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving s
• CVE-2026-21812 LOW 2.2 HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability

FAQ

How do I fix Azure vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Azure being exploited right now?

None of the tracked Azure CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Azure CVE should I patch first?

CVE-2026-110063 currently ranks highest (63/100): Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allo.

← Back to latest CVEs