Threat Brief — 2026-08-07: Microsoft Cloud Patch Flood

Microsoft dropped 20 new CVEs across its cloud and productivity stack, headlined by two remote code execution flaws in Azure Service Bus and Azure Confidential Ledger. A cluster of seven elevation-of-privilege bugs exploitable by unauthenticated attackers over the network — in Microsoft 365 Admin Center, Azure Kubernetes Service, Azure SQL Database, Teams, Power Apps, and Planetary Computer Pro — raises the most urgent concern. No public exploits or KEV listings have been tagged for any of these yet, but the attack surface spans identity, database, container orchestration, and collaboration services simultaneously.

Top items

• CVE-2026-50515 — Azure Service Bus Remote Code Execution (deserialization of untrusted data): An authorized attacker can achieve network-based RCE by feeding crafted data into Azure Service Bus deserialization logic. Service Bus is heavily used in enterprise messaging pipelines; RCE here could enable lateral movement or message tampering at scale. (src: MSRC)

• CVE-2026-68823 — Azure Confidential Ledger Remote Code Execution (exposed dangerous function): Authorized network-based attacker can execute arbitrary code via an exposed dangerous method in Azure Confidential Ledger — a service designed to store tamper-evident records. Compromise could undermine the integrity guarantees the ledger is supposed to provide. (src: MSRC)

• CVE-2026-62873 — Microsoft 365 Admin Center Elevation of Privilege (improper cryptographic signature verification, unauthenticated, network): Improper signature verification lets an unauthenticated network attacker escalate privileges in the M365 Admin Center — the central management console for tenant-wide configuration. This is the broadest-impact EoP in the batch. (src: MSRC)

• CVE-2026-50516 — Azure Kubernetes Service Elevation of Privilege (missing authentication, unauthenticated, network): Missing authentication for a critical AKS function lets an unauthenticated network attacker elevate privileges. Given AKS's role in container orchestration, this could enable cluster takeover without credentials. (src: MSRC)

• CVE-2026-63508 — Microsoft Planetary Computer Pro Elevation of Privilege (missing authentication, unauthenticated, network): Missing authentication for a critical function allows unauthenticated network-based privilege escalation in Planetary Computer Pro. (src: MSRC)

• CVE-2026-56162 — Azure SQL Database Elevation of Privilege (improper authentication, unauthenticated, network): Improper authentication enables an unauthenticated network attacker to elevate privileges in Azure SQL Database — a second Azure SQL flaw (CVE-2026-63522 is a separate authorized/local variant). (src: MSRC)

• CVE-2026-62836 — Azure SQL Managed Instance Elevation of Privilege (improper communication channel restriction, unauthenticated, network): An unauthenticated network attacker can escalate privileges by exploiting improper restriction of communication channels to intended endpoints in Azure SQL Managed Instance. (src: MSRC)

• CVE-2026-65667 — Microsoft Teams Elevation of Privilege (missing authorization, unauthenticated, network): Missing authorization in Teams allows unauthenticated network-based privilege escalation — one of two Teams EoP bugs disclosed today. (src: MSRC)

• CVE-2026-59118 — Microsoft Power Apps Elevation of Privilege (improper authorization, unauthenticated, network): Improper authorization permits unauthenticated network-based privilege escalation in Power Apps, potentially exposing low-code application backends. (src: MSRC)

• CVE-2026-50481 — Azure Active Directory Elevation of Privilege (modification of assumed-immutable data, authorized, network): A MAID vulnerability in Azure AD lets an authorized network attacker tamper with data assumed immutable to escalate privileges — identity-layer compromise with tenant-wide blast radius. (src: MSRC)

• CVE-2026-59115 — Microsoft Entra Provisioning Service (SyncFabric) Elevation of Privilege (path traversal via .../...//, authorized, network): A path-traversal variant in Entra's provisioning service lets an authorized network attacker escape intended directory boundaries to escalate privileges. (src: MSRC)

• CVE-2026-49163 — Application Insights Profiler Elevation of Privilege (path traversal, authorized, network): Path traversal in the Application Insights Profiler lets an authorized attacker escalate privileges over the network — relevant for anyone running App Insights profiling in production. (src: MSRC)

• CVE-2026-70332 — Microsoft Office SharePoint Spoofing (SSRF, unauthenticated, network): Server-side request forgery in SharePoint lets an unauthenticated network attacker perform spoofing — useful for internal port scanning or redirect attacks from a widely deployed collaboration platform. (src: MSRC)

• CVE-2026-62918 — Microsoft Teams Spoofing (improper cryptographic signature verification, unauthenticated, network): Improper signature verification in Teams enables unauthenticated spoofing — could be chained with the Teams EoP for socially convincing attack chains. (src: MSRC)

• CVE-2026-62869 — Azure Entra ID Spoofing (insufficient data authenticity verification, authorized, network): An authorized attacker can spoof identity data over the network due to insufficient authenticity verification in Entra ID. (src: MSRC)

• CVE-2026-65668 — Microsoft Purview eDiscovery Elevation of Privilege (improper access control, authorized, network): Improper access control in Purview eDiscovery allows an authorized network attacker to elevate privileges — relevant for legal/compliance data access paths. (src: MSRC)

• CVE-2026-62896 — Microsoft Teams Elevation of Privilege (improper authentication, authorized, network): Second Teams EoP today; this one requires an authenticated attacker exploiting improper authentication. (src: MSRC)

• CVE-2026-62830 — Azure SRE Agent Elevation of Privilege (missing authorization, authorized, network): Missing authorization in the Azure SRE Agent permits an authorized network attacker to escalate privileges. (src: MSRC)

• CVE-2026-56161 — Azure Logic Apps Information Disclosure (improper access control, authorized, network): An authorized attacker can disclose information over the network via improper access control in Logic Apps — relevant for workflow orchestration data exposure. (src: MSRC)

• CVE-2026-63522 — Azure SQL Database Elevation of Privilege (incorrect permission assignment, authorized, local): Local privilege escalation in Azure SQL Database via incorrect permission assignment — lower severity given the local/authorized scope, but still relevant for multi-tenant database hardening. (src: MSRC)

Themes

Unauthenticated network attack surface across Azure/M365. Seven of the 20 CVEs allow unauthenticated, network-based privilege escalation — spanning Admin Center, AKS, Azure SQL, Teams, Power Apps, Planetary Computer Pro, and SQL Managed Instance. This is an unusually high ratio of pre-auth bugs in a single Microsoft disclosure batch and should drive immediate patch prioritisation for internet-exposed management interfaces.

Identity layer under pressure. Three separate Entra/AAD vulnerabilities (EoP via MAID in Azure AD, path traversal in Entra Provisioning Service, and spoofing in Entra ID) all touch the identity control plane. Even the authorized-attacker variants carry tenant-wide escalation risk if a low-privilege account is compromised first.

Two RCEs in Azure messaging and ledger services. Azure Service Bus (deserialization) and Azure Confidential Ledger (exposed dangerous function) both permit network-based code execution by authenticated attackers. These services are often treated as trusted infrastructure; RCE undermines that assumption and could facilitate supply-chain-style downstream compromise.