Advisories
Microsoft Releases Critical Patches for 18 Azure and AI Product Vulnerabilities
Microsoft issued critical patches for 18 vulnerabilities affecting Azure services and Copilot AI products, primarily privilege‑elevation flaws. The fixes are server‑side and no exploitation has been reported. Defenders should update affected components and verify configuration changes.
What Happened
Microsoft released patches for 18 critical vulnerabilities across its Azure cloud portfolio and Copilot‑branded AI services. The majority were privilege‑elevation bugs that could allow attackers to gain higher access on the platform.
Impact
Affected services include Azure ARC, Azure AI Foundry, Azure Logic Apps, Azure Billing, Azure HorizonDB, Azure Cosmos DB, Azure Container Registry, Microsoft Fabric, Microsoft Dataverse, Microsoft 365 Copilot, and Azure Machine Learning. Information‑disclosure flaws were also fixed in Copilot and Microsoft 365 Copilot Business Chat, while a spoofing issue was addressed in Azure Portal.
What Defenders Should Do
- Apply the latest security updates to all listed Azure services and Copilot products.
- Verify that privilege‑elevation controls are correctly enforced and that no legacy configuration grants excessive rights.
- Review audit logs for unusual privilege changes and monitor for any signs of exploitation.
- Consider enabling Azure Security Center recommendations and Azure Policy to enforce least‑privilege.
Mitigation Status
Microsoft confirmed that all fixes are applied server‑side and no active exploitation has been observed. No public exploits or malware leveraging these CVEs are known.
Related vulnerabilities
Microsoft's September 2026 Patch Tuesday: 972 CVEs, 113 Critical, 2 Exploited Zero‑Days
On Patch Tuesday, Microsoft pushed 972 security updates, including 113 critical flaws and two zero‑day vulnerabilities that were actively leveraged in the wild. The patches cover Windows, Office, and Azure services, addressing remote code execution, privilege escalation, and data exfiltration risks. Security teams must deploy the updates immediately, validate coverage, and monitor for any lingering exposure, especially in legacy or exposed environments.
Read briefing
Microsoft Patch Tuesday 2026: 972 CVEs Fixed, 113 Critical, 2 Exploited Zero‑Days Resolved
Microsoft’s September 2026 Patch Tuesday covered 972 vulnerabilities, including 113 critical flaws and two zero‑days that had already been weaponized. The rollout spans Windows, Office, and Azure services, tightening a broad attack surface. Security teams are urged to deploy the patches immediately, confirm coverage, and monitor for lingering exploitation attempts. CrowdStrike’s threat intel stresses the shrinking exploitation window and the need for continuous vigilance.
Read briefing
Malwarebytes Secures AV‑TEST Top Product Award with 18/18 Score
Malwarebytes achieved a perfect 18‑point score in AV‑TEST’s Windows Consumer Security Product Test, earning the Top Product award for the July/August cycle. The product also earned Level 1 Certification from MRG Effitas and blocked 100 % of live threats in AVLab’s Advanced In‑the‑Wild Malware Test. Defenders should verify current versions and enable real‑time protection to maintain these results.
Read briefing
Microsoft Patch Tuesday 2026: 972 CVEs, 113 Critical, Two Exploited Zero‑Days
Microsoft’s September 2026 Patch Tuesday saw 972 vulnerabilities patched, including 113 rated critical and two zero‑days that were already in the wild. CrowdStrike’s latest security releases emphasize supply‑chain protection and AI‑driven SOC evolution, underscoring the need for rapid patching and advanced detection.
Read briefing