Microsoft Security Center Center News

Information published.

Information published.

Information published. This CVE was addressed by updates that were released in September 2026, but the CVE was inadvertently omitted from the September 2026 Security Updates. This is an informational change only. Customers who have already installed the September 2026 updates do not need to take any further action.

Information published.

Updated an acknowledgement. This is an informational change only.

Updated an acknowledgement. This is an informational change only.

Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally.

Information published.

Updated an acknowledgement. This is an informational change only.

Updated an acknowledgement. This is an informational change only.

Added Office software to the Security Updates table. Customers that are running supported version of Office are encouraged to update to the indicated version to be protected from this vulnerability.

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network.

Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.

Information published.

Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network.

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.

Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.