Threat Brief — 2026-07-24 — Microsoft Cloud CVE Flood

Executive summary: Microsoft's MSRC feed dropped 14 new CVEs in a single batch, spanning Azure platform services, M365 Copilot, Microsoft Account, and Surface. Four are remote code execution flaws; seven are elevation-of-privilege issues across Azure DNS, Key Vault, AKS, AI Search, App Service, ARO, and a Data Quality service. Several of the EoP bugs are exploitable by unauthorized attackers over a network — notably Azure Key Vault and AKS — making them the highest-priority items for cloud-dependent teams to track as patch details emerge.

Top items

• CVE-2026-56165 — Microsoft Account RCE via heap-based buffer overflow (unauthorized, network-reachable). This is the standout: a heap-based buffer overflow in Microsoft Account's authentication surface exploitable by an unauthenticated attacker over a network. Any flaw in the identity layer that Microsoft Account underpins could have broad blast radius. (src: RSS:msrc-security-updates)

• CVE-2026-62825 — Azure Key Vault EoP via improper authentication (unauthorized). Key Vault stores certificates, secrets, and keys; an unauthenticated network attacker gaining elevation of privilege here could pivot to any downstream service relying on those secrets. Priority watch for any Azure-hosted workload. (src: RSS:msrc-security-updates)

• CVE-2026-56163 — Azure Kubernetes Service EoP via missing authentication for critical function (unauthorized). A missing-authentication flaw in AKS lets an unauthenticated network attacker elevate privileges. Given AKS's role as container orchestration for many enterprises, this deserves immediate attention pending patch availability. (src: RSS:msrc-security-updates)

• CVE-2026-35425 — Azure API Management (APIM) RCE via improper access control (authorized attacker). APIM sits at the edge of many Azure architectures as a gateway; an authorized attacker exploiting an access-control gap to achieve RCE could intercept or manipulate API traffic organisation-wide. (src: RSS:msrc-security-updates)

• CVE-2026-50517 — M365 Copilot RCE via deserialization of untrusted data (authorized attacker). Deserialization RCE in Copilot implies an attacker with some level of access can achieve code execution on the processing tier. Relevant for organisations allowing broad Copilot adoption. (src: RSS:msrc-security-updates)

• CVE-2026-58275 — Azure DNS EoP via missing authorization (unauthorized). A missing-authorization flaw in Azure DNS could allow unauthenticated privilege escalation, potentially enabling DNS manipulation or tenant-level disruption. (src: RSS:msrc-security-updates)

• CVE-2026-56191 — Exchange Online tampering via improper authentication (unauthorized). Unauthenticated tampering with Exchange Online could allow message integrity violations. This is distinct from the ongoing Exchange Online mailbox-quarantine outage first reported 2026-07-23 (RSS:bleepingcomputer-main) — that was an operational bug, not a security CVE. (src: RSS:msrc-security-updates)

• CVE-2026-54120 — Microsoft Surface RCE via improper input validation (authorized attacker). A network-reachable RCE in Surface firmware/driver stack; lower priority given authorized-attacker requirement, but relevant for BYOD or shared-device environments. (src: RSS:msrc-security-updates)

• CVE-2026-58630 — Azure App Service on Azure Stack Hub EoP (unauthorized). Improper access control in App Service for Azure Stack Hub deployments; relevant only for on-prem Azure Stack operators but exploitable by unauthorized attackers. (src: RSS:msrc-security-updates)

• CVE-2026-57106 & CVE-2026-56167 — SSRF-based EoP in Data Quality and Azure AI Search. Both use server-side request forgery to achieve privilege elevation. Data Quality is exploitable by unauthorized attackers; Azure AI Search requires an authorized attacker. The SSRF pattern across two separate Azure services in the same batch is notable. (src: RSS:msrc-security-updates), (src: RSS:msrc-security-updates)

• CVE-2026-56160 — Azure Red Hat OpenShift EoP via improper authorization (authorized attacker). ARO privilege escalation; limited to ARO customers but worth patching in managed OpenShift update windows. (src: RSS:msrc-security-updates)

• CVE-2026-62835 & CVE-2026-49159 — Information disclosure in Online Services and Microsoft Graph. Both expose sensitive information to an authorized attacker over a network. Lower severity but relevant for data-classification boundaries in M365 tenants. (src: RSS:msrc-security-updates), (src: RSS:msrc-security-updates)

Themes

Azure platform identity-and-access gap. Seven of fourteen CVEs are elevation-of-privilege flaws across Azure services (DNS, Key Vault, AKS, App Service, ARO, AI Search, Data Quality). The recurring root causes — missing authorization, improper authentication, missing authentication for critical functions — suggest a systemic access-control weakness across Azure control planes. Prioritise patching the unauthenticated-attacker subset (Key Vault, AKS, DNS, App Service on Stack Hub) first.

SSRF recurring as an EoP vector. Two separate Azure services (Data Quality, AI Search) use SSRF to achieve privilege elevation. This echoes patterns seen in cloud-metadata and internal-endpoint abuse. If your Azure architecture lacks network segmentation between PaaS services, these SSRF bugs could chain into broader compromise.

AI-adjacent attack surface expanding. M365 Copilot RCE and Azure AI Search EoP both appear in this batch. As Microsoft embeds AI into core services, the attack surface grows into new processing tiers that may not yet have mature security monitoring.