Topic

MSRC: news, advisories and analysis

11 articlesUpdated 18 Oct 2026

CyberSecureToday covers MSRC across 11 articles published between 17 Sep 2026 and 18 Oct 2026. The coverage includes 10 vulnerability advisories and 1 analysis or guidance piece. 10 advisories are rated critical or high severity, and 1 involves a flaw listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on MSRC most often intersect with Microsoft Azure, Privilege Escalation and Cloud Security, with Technology, Cloud & SaaS the most affected sector. The most recent story, “Windows OLE Untrusted Pointer Dereference Flaw Enables Network-Based Remote Code Execution”, was published 18 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSCritical
Windows OLE Untrusted Pointer Dereference Flaw Enables Network-Based Remote Code Execution
A critical untrusted pointer dereference vulnerability in Windows OLE (CVE-2026-96924) enables remote, unauthenticated code execution without user interaction.
CST Editorial Desk18 Oct 20269 min read
ThreatsCloud & SaaSHigh
Azure Monitor Agent Untrusted Search Path Flaw Enables Local Privilege Escalation CVE-2026-42830
Microsoft MSRC bulletin details an untrusted search path vulnerability in Azure Monitor Agent Metrics Extension allowing low-privileged users to attain SYSTEM privileges.
Aisha Noor27 Sep 20268 min read
ThreatsCloud & SaaSCritical
Microsoft Entra ID Assumed-Immutable Data Modification Flaw Enables Tenant Privilege Escalation CVE-2026-50481
A critical vulnerability in Microsoft Entra ID allows authenticated users to manipulate assumed-immutable directory attributes and achieve Global Admin rights.
Aisha Noor27 Sep 20269 min read
ThreatsCloud & SaaSHigh
Microsoft Outlook Memory Parsing Flaw Enables Remote Code Execution via Crafted Documents
Microsoft MSRC discloses high-severity 8.8 CVSS RCE flaw CVE-2026-70125 in Microsoft Outlook enabling arbitrary code execution via crafted compound documents.
CST Editorial Desk26 Sep 202614 min read
ThreatsCloud & SaaSCritical
Azure AI Language Authentication Flaw Enables Unauthenticated Model Tampering
Microsoft mitigates maximum-severity CVSS 10.0 flaw CVE-2026-70352 in Azure AI Language Authoring, preventing unauthenticated remote tampering with enterprise AI models.
CST Editorial Desk24 Sep 202617 min read
ThreatsCloud & SaaSHigh
Azure AI Foundry Server-Side Request Forgery Flaw Exposes Internal Agent Infrastructure CVE-2026-85917
Microsoft discloses high-severity flaw CVE-2026-85917 in Azure AI Foundry allowing unauthenticated attackers to execute SSRF and elevate privileges over the network.
CST Editorial Desk23 Sep 202615 min read
ThreatsCloud & SaaSCritical
Azure Cosmos DB Injection Flaw Enabled Cloud Privilege Escalation
Microsoft addresses CVSS 9.6 vulnerability CVE-2026-87701 in Azure Cosmos DB allowing authenticated attackers to execute downstream injection and elevate privileges.
CST Editorial Desk23 Sep 202615 min read
ThreatsCloud & SaaSHigh
Microsoft Azure CLI Command Injection Vulnerability CVE-2026-83948 Exposes Cloud CI/CD Automation Runners
Microsoft patches important command injection flaw CVE-2026-83948 in Azure CLI, requiring customer updates to prevent remote code execution in CI/CD pipelines.
Aisha Noor22 Sep 202614 min read
ThreatsCloud & SaaSCritical
Azure HorizonDB Critical Flaw CVE-2026-48567 Allows Complete Authentication Bypass via Token Spoofing
Microsoft resolves maximum-severity CVSS 10.0 vulnerability CVE-2026-48567 in Azure HorizonDB allowing network attackers to bypass authentication and seize cluster control.
Aisha Noor21 Sep 202615 min read
InsightsCloud & SaaS
Microsoft Resolves CVSS 10.0 Azure AI Foundry Authentication Bypass and Privilege Escalation Flaw
Microsoft patches maximum-severity CVSS 10.0 flaw CVE-2026-85889 in Azure AI Foundry enabling unauthenticated remote network privilege escalation.
Aisha Noor18 Sep 202612 min read
ThreatsCloud & SaaSCritical
Microsoft SQL Server Memory Corruption RCE Flaw Exploited in Database Infiltration Attacks
CISA adds Microsoft SQL Server vulnerability CVE-2019-1068 (CVSS 9.8) to KEV catalog following active in-the-wild exploitation against enterprise database clusters.
CST Editorial Desk17 Sep 202614 min read