Microsoft’s 22 Cloud Fixes Shrink Local Patch Work
Microsoft rolled out 22 security fixes across Azure, Entra ID, Exchange, Fabric, Partner Center, and related cloud services, including several CVSS 10.0 bugs. Microsoft says most of the mitigations are already deployed server-side, so not every affected customer has a box to patch.
The highest-severity issues include elevation-of-privilege bugs in Azure SQL Database, Azure Arc, Exchange Online, Microsoft Fabric, Azure Logic Apps, Azure Data Factory, and Entra ID, plus remote code execution flaws in Azure Managed Instance for Apache Cassandra and Entra ID. In plain terms, some bugs could let a lower-privileged user gain more control or run code inside Microsoft-managed services, which matters most where those services sit on tenant-control or identity paths.
The practical map is narrower than the headline suggests: many of these defects live in Microsoft-run infrastructure, but the customer-remediated services still define where cloud control and identity exposure can persist until updates land. For teams that depend on Azure and Entra to broker access, the question is not just whether a product is current, but which service layer owns the fix.