Missing Authentication in Microsoft Azure AI Foundry Enables Privilege Escalation
CVE-2026-85889 is a missing authentication flaw (CWE-306) in Microsoft Azure AI Foundry, meaning a critical function can be reached without any credential check. An unauthenticated attacker can trigger it remotely over a network with no user interaction and no privileges required. Successful exploitation allows the attacker to elevate privileges, and the CVSS scope-change designation (S:C) indicates the impact can extend beyond the initially compromised security authority, with high confidentiality, integrity, and availability impact. Any organization using Azure AI Foundry is potentially affected, though the flaw is in a Microsoft-managed cloud platform rather than a customer-deployed package. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known.
· Microsoft Azure AI Foundrylarge
Improper Authorization in Azure Database for PostgreSQL Enables Privilege Escalation
CVE-2026-85878 is an improper authorization flaw (CWE-285) in Microsoft's Azure Database for PostgreSQL managed service. An attacker who already holds some authorized, low-privilege access — such as an authenticated database user — can send network requests that the service fails to properly authorize, thereby elevating their privileges. The CVSS 3.1 score of 9.9 reflects network exploitability, low attack complexity, no user interaction, a scope change (impact extending beyond the vulnerable component), and high impact on confidentiality, integrity, and availability. All customers running Azure Database for PostgreSQL are potentially affected until remediated. The flaw is not currently listed in CISA's Known Exploited Vulnerabilities catalog and no public proof-of-concept is known.
· Microsoft Azure Database for PostgreSQL Managed cloud service; all deployments current at the time of disclosure (no specific version ranges disclosed in the data)mass
Command Injection Privilege Escalation in Microsoft 365 Copilot
CVE-2026-85885 is a command injection flaw (CWE-77) in Microsoft 365 Copilot in which special elements in user-supplied input are improperly neutralized before being passed to a command interpreter. An authorized, low-privileged user can trigger it over the network with crafted input and no user interaction or special conditions. Successful exploitation elevates the attacker's privileges, with high impact to confidentiality, integrity, and availability, and the changed scope in the CVSS vector indicates impact can extend beyond the initially compromised component. Any organization whose users have Microsoft 365 Copilot enabled is in scope, since the flaw resides in Microsoft's cloud service rather than a locally installed product. There is currently no evidence of exploitation in the wild, no public proof-of-concept, and the flaw is not listed in CISA's KEV catalog.
· Microsoft 365 Copilotmass
Double Free in Windows Secure Kernel Mode Enables Local Privilege Escalation
CVE-2026-85921 is a double free flaw (CWE-415) in Windows Secure Kernel Mode, the hypervisor-based component that underpins Virtualization-Based Security (VBS) on Windows clients and servers. It is triggered locally by an already-authorized attacker who holds high privileges on the machine (per the CVSS vector, privileges required: high), and successful exploitation lets them elevate privileges across a security boundary — escaping the isolation that Secure Kernel is meant to enforce — with high impact on confidentiality, integrity, and availability. In practice, an attacker with administrative code execution on a VBS-enabled host could leverage the bug to break out of or subvert the secure-kernel boundary and gain deeper, SYSTEM/hypervisor-adjacent control of the system. Any Windows deployment running Secure Kernel Mode (i.e., with VBS/HVCI or Hyper-V-based isolation enabled) is in scope. As of this writing there is no known public proof of concept, and the flaw is not listed in CISA's Known Exploited Vulnerabilities catalog.
· Microsoft Windows Secure Kernel Modemass
Injection-Based Privilege Elevation in Azure Cosmos DB
Azure Cosmos DB contains an improper neutralization flaw (CWE-74) in which special elements in attacker-controlled input are passed unneutralized into output consumed by a downstream component, enabling an injection attack. The flaw is triggered over the network by an attacker who already holds a low-privilege, authorized position (such as a legitimate tenant or data-plane account), with no user interaction required. Because the CVSS scope is 'changed', successful exploitation crosses a security boundary, and the attacker gains elevated privileges with high confidentiality and integrity impact (no availability impact). All customers using the managed Azure Cosmos DB service are potentially affected, since fixes must be delivered through Microsoft's service updates. As of this writing, the flaw is not in CISA's KEV catalog and no public proof-of-concept or confirmed in-the-wild exploitation is known.
· Microsoft Azure Cosmos DB Managed cloud service (all customer-facing environments; no specific version range disclosed)mass
Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally.
Insufficient granularity of access control in User-Mode Power Service (UMPS) allows an authorized attacker to elevate privileges locally.
· microsoft windows 10 1607 · microsoft windows 10 1809—