Microsoft patched 18 vulnerabilities across its Azure cloud portfolio and AI-branded products, including Azure ARC, Azure AI Foundry, Azure Logic Apps, Azure Billing, Azure HorizonDB, Azure Cosmos DB, Azure Container Registry, Microsoft Fabric, Microsoft Dataverse, and Microsoft 365 Copilot. The majority of these flaws are privilege escalation vulnerabilities. Several information disclosure vulnerabilities were also fixed in Copilot-related products and Azure Machine Learning, along with a spoofing vulnerability in Azure Portal. Microsoft rated these vulnerabilities as critical, though CVSS scores indicate some are of medium or high severity. The vulnerabilities were discovered both internally and by external researchers. None have been exploited in the wild. All patches were applied server-side, so customers do not need to take action. Separately, Microsoft patched a Windows privilege escalation vulnerability (CVE-2026-85921) that requires user updates, though exploitation is considered less likely. This patch release is part of a record-breaking update addressing 970 vulnerabilities across Microsoft products, reflecting increased vulnerability discovery linked to AI usage.

The vulnerabilities could allow attackers to escalate privileges within affected Azure and AI services, potentially leading to unauthorized access or control. Information disclosure and spoofing vulnerabilities could expose sensitive data or allow impersonation within cloud and AI environments. However, no exploitation has been reported in the wild. The Windows privilege escalation vulnerability requires user patching but is considered less likely to be exploited. Overall, the impact is significant given the critical ratings, but mitigated by the absence of known active exploitation and server-side patching for cloud services.

Microsoft has implemented all fixes server-side for the Azure and AI product vulnerabilities, so customers do not need to take any action for these cloud services. For the Windows privilege escalation vulnerability (CVE-2026-85921), users should apply the available Windows update to remediate the flaw. Customers should monitor official Microsoft advisories for any further guidance.