Microsoft Patches 18 Vulnerabilities Across Azure and Copilot Products
Summary
Microsoft patched 18 vulnerabilities across Azure and Copilot products. None are known to be exploited, and the fixes were server-side, requiring no customer action. Microsoft also issued a Windows privilege-escalation patch that users must install.
Key points
- Microsoft patched 18 vulnerabilities affecting Azure cloud services and Copilot-branded products.
- Most flaws were elevation-of-privilege vulnerabilities; others involved information disclosure and spoofing.
- Microsoft rated all 18 vulnerabilities critical, though some CVSS scores indicated high or medium severity.
- None of the 18 vulnerabilities were flagged as exploited, and the fixes were implemented server-side, so customers do not need to take action.
- A separate Windows privilege-escalation flaw, CVE-2026-85921, requires users to install an update; Microsoft considers exploitation less likely.
- Microsoft said it fixed a record 970 vulnerabilities across its products with the latest Patch Tuesday updates.
Article Details
- Event Type
- Microsoft security patch release addressing 18 vulnerabilities across Azure cloud and Copilot AI products, plus a separate Windows privilege escalation vulnerability.
- Impact
- The 18 Azure and Copilot vulnerabilities were not reported as exploited, and Microsoft said their fixes were implemented server-side, requiring no customer action. The separate Windows flaw, CVE-2026-85921, requires users to update Windows; Microsoft assessed exploitation as less likely.
CVE
Vendors
Products
Azure AI FoundryElevation of privilege flaws made up the bulk of the disclosures, affecting Azure ARC, Azure AI Foundry, Azure Logic Apps, Azure Billing, Azure HorizonDB, Azure Cosmos DB, Azure Container Registry, Microsoft Fabric,Azure ArcElevation of privilege flaws made up the bulk of the disclosures, affecting Azure ARC, Azure AI Foundry, Azure Logic Apps, Azure Billing, Azure HorizonDB, Azure Cosmos DB, Azure Container Registry, Microsoft Fabric,Azure Billingflaws made up the bulk of the disclosures, affecting Azure ARC, Azure AI Foundry, Azure Logic Apps, Azure Billing, Azure HorizonDB, Azure Cosmos DB, Azure Container Registry, Microsoft Fabric, Microsoft Dataverse,Azure Container RegistryAzure ARC, Azure AI Foundry, Azure Logic Apps, Azure Billing, Azure HorizonDB, Azure Cosmos DB, Azure Container Registry, Microsoft Fabric, Microsoft Dataverse, and Microsoft 365 Copilot.Azure Cosmos DBaffecting Azure ARC, Azure AI Foundry, Azure Logic Apps, Azure Billing, Azure HorizonDB, Azure Cosmos DB, Azure Container Registry, Microsoft Fabric, Microsoft Dataverse, and Microsoft 365 Copilot.Azure HorizonDBthe bulk of the disclosures, affecting Azure ARC, Azure AI Foundry, Azure Logic Apps, Azure Billing, Azure HorizonDB, Azure Cosmos DB, Azure Container Registry, Microsoft Fabric, Microsoft Dataverse, and Microsoft 365Azure Logic Appsof privilege flaws made up the bulk of the disclosures, affecting Azure ARC, Azure AI Foundry, Azure Logic Apps, Azure Billing, Azure HorizonDB, Azure Cosmos DB, Azure Container Registry, Microsoft Fabric,Azure Machine LearningSeveral information disclosure vulnerabilities were addressed in Copilot, Microsoft 365 Copilot, Microsoft 365 Copilot Business Chat, and Azure Machine Learning.Azure PortalA single spoofing vulnerability was patched in Azure Portal.Microsoft 365 CopilotHorizonDB, Azure Cosmos DB, Azure Container Registry, Microsoft Fabric, Microsoft Dataverse, and Microsoft 365 Copilot.Microsoft 365 Copilot Business ChatSeveral information disclosure vulnerabilities were addressed in Copilot, Microsoft 365 Copilot, Microsoft 365 Copilot Business Chat, and Azure Machine Learning.Microsoft DataverseApps, Azure Billing, Azure HorizonDB, Azure Cosmos DB, Azure Container Registry, Microsoft Fabric, Microsoft Dataverse, and Microsoft 365 Copilot.Microsoft FabricAzure Logic Apps, Azure Billing, Azure HorizonDB, Azure Cosmos DB, Azure Container Registry, Microsoft Fabric, Microsoft Dataverse, and Microsoft 365 Copilot.Microsoft WindowsMicrosoft also announced patches this week for a privilege escalation vulnerability affecting Windows.