NCSC-NL issued an advisory on October 13 covering Microsoft Azure flaws across Key Vault, DevOps, API Center, Storage, Event Grid, the SRE Agent, and the Storage Library. The list includes CVE-2026-85922, CVE-2026-85925, CVE-2026-88132, CVE-2026-69877, CVE-2026-88094, CVE-2026-100207, and CVE-2026-96205, while four other CVEs are noted as already centrally fixed by Microsoft.
The underlying issues span weak authentication, missing authorization, SSRF (server-side request forgery), improper certificate validation, origin validation errors, and OS command injection. In plain terms, an attacker could bypass checks, reach services they should not see, or pull back sensitive data; in some cases the flaw can raise privileges or lead to code execution.
For Azure estates, the important part is the control-plane mix: a hit on one component can become a step toward secrets or higher rights in adjacent services. The advisory also means not every CVE listed here implies local remediation, because Microsoft already fixed four of them centrally.
CVSS 10 CRITICAL: improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges… EPSS 0.5% (39th percentile).