Threat database

Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.

Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.

Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.

BlueHammer (CVE-2026-33825) is a local privilege escalation chain targeting Windows Defender Antimalware Platform versions before 4.18.26030.3011. It requires initial code execution as a standard user and uses a series of legitimate Windows mechanisms to escalate privileges to NT AUTHORITY\SYSTEM. The exploit freezes the MsMpEng.exe process via CloudFilter manipulation and stages malicious update files. Laboratory tests demonstrated successful privilege escalation, recovery of domain-admin credentials from LSASS, and lateral movement using pass-the-hash techniques to compromise domain controllers. Exploitability depends on runtime factors such as pending signature updates, Defender state, filter drivers, VSS, and CloudFilter reachability. No known exploits are reported in the wild, and no patch information is provided.

CVE-2026-80092 is an authentication bypass vulnerability in Microsoft Identity Web that allows an authorized attacker to elevate privileges over a network. The issue stems from assumed-immutable data leading to improper authentication checks. A fix is available and has been officially released by Microsoft. The vulnerability affects versions from 1.0.0 up to but not including 4.16.1. The CVSS 3.1 base score is 5.3, indicating medium severity.

CVE-2026-109461 is an origin validation error vulnerability in Microsoft Authentication Library (MSAL) for Node.js. It allows an unauthorized attacker to disclose information over a network. The vulnerability affects Microsoft Identity Client for NodeJS versions from 5.0.0 up to but not including 7.1.0. The issue has a medium severity with a CVSS score of 5.9. An official fix is available from Microsoft.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.

Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.