Veille CVE

Recherche « Microsoft Azure Local »

13 CVE

Critique 4 Élevée 7 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Microsoft Azure Local » ✕
  1. CVE-2026-85916 5.5 Moyenne

    Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1

    Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally.

  2. CVE-2026-100207 7.3 Élevée

    Microsoft Azure CycleCloud 8.9.1

    Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to execute code locally.

  3. CVE-2026-84458 9.1 Critique

    zammad

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party (SSO) identity to an existing local account by matching the email address the identity provider reports, without verifying that the provider actually confirmed ownership of that email. An attacker who controls any identity at a configured provider, including, by default, any Azure AD tenant via Zammad's multi-tenant Microsoft 365 /common app registration, can set that identity's email to a victim's address, authenticate, and be logged in as the victim. This bypasses the victim's local password entirely and affects any existing account, including agents and administrators. Zammad will honor the xms_edov ID token claim when email verification is required in the Microsoft 365 setting, treating a missing claim as unverified. This issue is fixed in version 7.1.2.

  4. CVE-2026-63522 7.8 Élevée

    Microsoft Azure SQL Database

    Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally.

  5. CVE-2026-54733 9.3 Critique

    microsoft o365-moodle

    The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5.1.1, the Microsoft Office 365 Integration plugin local_o365 Teams SSO endpoint sso_login.php base64-decodes a JWT payload and authenticates users from the upn claim without verifying the JWT signature, allowing an unauthenticated attacker to forge a token and obtain a Moodle session as an O365-authenticated user. This issue is fixed in versions 4.5.6, 5.0.5, and 5.1.1.

  6. CVE-2026-45476 8.2 Élevée

    Microsoft Linux kernel - Microsoft MANA Network Driver · Microsoft azure network adapter

    Use after free in Linux MANA Driver allows an authorized attacker to elevate privileges locally.

  7. CVE-2026-32193 8.8 Élevée

    Microsoft Azure Kubernetes Service

    Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally.

  8. CVE-2026-45108 8.4 Élevée

    himmelblau-idm himmelblau

    Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 2.0.0 to before 3.1.5 and 2.3.11, Himmelblau contained an authentication bypass vulnerability in the Device Authorization Grant (DAG) flow that allowed a user within the same Entra ID domain to obtain a local Unix session as another user by providing their own valid credentials. The vulnerability existed in the token_validate function, which validated domain aliases for legitimate multi-domain scenarios but failed to verify that the local part (username) of the authenticated user's UPN matched the requested account username. The function only compared domains, not the complete usernames. This vulnerability is fixed in 3.1.5 and 2.3.11.

  9. CVE-2026-42822 10.0 Critique

    Microsoft Azure Local · Microsoft azure resource manager

    Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network.

  10. CVE-2026-42830 6.5 Moyenne

    Microsoft Azure Monitor Agent Metrics Extension · Microsoft azure monitor agent

    Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.

  11. CVE-2026-40381 7.8 Élevée

    Microsoft Azure Connected Machine Agent

    Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.

  12. CVE-2026-33117 9.1 Critique

    Microsoft Azure SDK for Java

    The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

  13. CVE-2026-32204 7.8 Élevée

    Microsoft Azure Monitor · Microsoft azure monitor agent

    External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.