ZDI lists November 2026 Microsoft fixes, one Outlook bug exploited
CVE-2026-124194 is the only listed flaw marked exploited; it is a Moderate CVSS 6.5 spoofing bug.
74
CVE-2026-114160
Unauthenticated privilege elevation in Azure Managed Grafana
- CVSS 3.1
- 9.8 critical
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Azure Managed Grafana has a flaw (CWE-918) that lets an unauthorized attacker elevate privileges over the network. No user interaction or prior account is required. Successful exploitation yields high impact to confidentiality, integrity, and availability of the managed Grafana service. Microsoft has not listed affected builds.
What to do: Apply Microsoft's update for CVE-2026-114160. No workaround is stated.
| Product | Affected |
|---|---|
| Microsoft Azure Managed Grafana | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.
- Weakness
- CWE-918
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
2 storiesMicrosoft November 2026 update fixes 1,093 flaws, one Outlook zero-day
Opening a crafted file can leak an NTLMv2 hash; the Preview Pane is not an attack vector.
74