Vulnerabilities · 22h ago

NCSC flags multiple Azure control-plane flaws

NCSC-NL issued an advisory on October 13 covering Microsoft Azure flaws across Key Vault, DevOps, API Center, Storage, Event Grid, the SRE Agent, and the Storage Library. The list includes CVE-2026-85922, CVE-2026-85925, CVE-2026-88132, CVE-2026-69877, CVE-2026-88094, CVE-2026-100207, and CVE-2026-96205, while four other CVEs are noted as already centrally fixed by Microsoft.

The underlying issues span weak authentication, missing authorization, SSRF (server-side request forgery), improper certificate validation, origin validation errors, and OS command injection. In plain terms, an attacker could bypass checks, reach services they should not see, or pull back sensitive data; in some cases the flaw can raise privileges or lead to code execution.

For Azure estates, the important part is the control-plane mix: a hit on one component can become a step toward secrets or higher rights in adjacent services. The advisory also means not every CVE listed here implies local remediation, because Microsoft already fixed four of them centrally.

CVE-2026-96207

NVD KEV

CVSS 10 CRITICAL: improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges… EPSS 0.5% (39th percentile).

CVE-2026-69435

NVD KEV

CVSS 9.6 CRITICAL: missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

CVE-2026-83943

NVD KEV

CVSS 8.7 HIGH: exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to…

CVE-2026-83947

NVD KEV

CVSS 7.7 HIGH: missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.

Timeline

Sources

2 sources covering this story

Entities

Vendor digest: Microsoft

Part of the PlainSec briefing for 2026-10-14

Editions

Related stories