September 2026 Patch Tuesday briefing

Executive briefing

Executive Summary

Two Windows elevation-of-privilege vulnerabilities are being actively exploited, and both carry a CISA KEV deadline of 2026-09-22. If an attacker already has a foothold on a Windows endpoint (often via phishing, stolen credentials, or a commodity loader), these bugs can help them quickly turn that access into full control—accelerating ransomware deployment and domain-wide impact.

September 2026 is a high-volume, elevated-risk Patch Tuesday: 998 CVEs total, up sharply from 405 last month. While only 2 CVEs are confirmed exploited, the release is dominated by Windows fixes (726) and a heavy concentration of Elevation of Privilege (438) and Remote Code Execution (258) issues—exactly the mix that enables “initial access → privilege escalation → lateral movement → ransomware” kill chains.

Bottom line: Treat this as an elevated-risk month—patch the two exploited Windows privilege-escalation CVEs immediately (by 2026-09-22), then prioritize Windows remote-exposure services (RDP/DNS/DHCP) and Office attack paths.

Key Risks

CVE-2026-81963 — Windows Update Stack Elevation of Privilege

Actively exploited / CISA KEV deadline: 2026-09-22. This is a post-compromise accelerator: once an attacker lands on a Windows machine, they can use this weakness to gain higher privileges and take actions normally restricted to administrators—disabling security tools, dumping credentials, and staging ransomware.

What the attacker needs: Existing local access on the device (for example, a compromised user account or malware already running). No user click is required at exploitation time—the attacker runs code locally to elevate privileges. Why it matters: it shortens the time from “one infected laptop” to enterprise-wide impact, increasing the likelihood of data theft and rapid encryption events.

CVE-2026-85880 — Windows ALPC Elevation of Privilege

Actively exploited / CISA KEV deadline: 2026-09-22. Attackers can leverage this to break out of low-privilege execution and operate with elevated rights on the same system—often the difference between a contained incident and a full breach.

What the attacker needs: Existing access to run code locally (malware execution, compromised user session, or an attacker already on the box). No interaction from the user is required once the attacker has that foothold. Why it matters: elevated privileges enable credential access, persistence, defense evasion, and lateral movement, raising the blast radius and recovery cost.

CVE-2026-69525 — Remote Desktop Services Remote Code Execution

Remote Desktop remains a high-value target because it’s often exposed internally—and sometimes to the internet through misconfiguration. This vulnerability can allow an attacker to run code on an RDP-enabled system remotely, turning a single reachable service into a direct path to server takeover.

What the attacker needs: Network reachability to Remote Desktop Services on the target (internet-exposed or reachable from a compromised internal host). No user click is required if the service is reachable. Why it matters: RDP compromise is a common precursor to ransomware staging, domain escalation, and rapid lateral movement, especially in flat networks.

CVE-2026-69730 — Windows DNS Server Remote Code Execution

DNS is foundational infrastructure; a compromise here is disproportionately damaging. This issue can allow an attacker to remotely execute code on a DNS server, potentially enabling traffic manipulation, credential interception paths, or broad service disruption.

What the attacker needs: Network access to the DNS server service (typically internal, but reachable from many segments). No user interaction is required. Why it matters: DNS server compromise can become a control-plane breach—supporting stealthy redirection, facilitating lateral movement, and undermining trust in core network services.

CVE-2026-78509 — Microsoft Office Outlook Remote Code Execution

Outlook is a prime entry point because it sits at the center of business workflows. This vulnerability can allow an attacker to execute code on a user’s machine via malicious email content, enabling initial access, credential theft, and follow-on intrusion.

What the attacker needs: Typically a targeted email delivered to a user; exploitation commonly depends on the user opening or previewing content (attackers will design lures to blend into normal business traffic). Why it matters: Outlook-based compromise is a reliable path to endpoint takeover, mailbox access, and internal phishing—often the first step toward broader compromise.

Threat Landscape

The standout pattern this month is scale plus privilege escalation: nearly a thousand CVEs, with Elevation of Privilege leading all categories. That aligns with real-world attacker behavior—most intrusions start with limited access, and the fastest way to turn that into a major incident is to escalate privileges on Windows and then move laterally.

Confirmed exploitation is up vs. last month (2 vs. 1), and both exploited issues are Windows local privilege escalations—a strong signal that adversaries are actively chaining “initial access” techniques (phishing, stolen creds, commodity malware) with reliable privilege-escalation tooling to speed up ransomware and data-theft operations. Meanwhile, the large set of Windows remote-code-execution fixes in core services (notably RDP and DNS) reinforces that exposed or broadly reachable services remain a primary enterprise risk driver.

Recommended Actions

1. Patch immediately (Endpoint/Server Ops): CVE-2026-81963 and CVE-2026-85880 across Windows and ESU populations. Meet the CISA KEV deadline: 2026-09-22. Prioritize admin workstations, jump boxes, VDI pools, and systems used for software deployment/management.

2. Reduce remote attack surface now (Network + Windows Server teams): Prioritize patching and exposure review for Remote Desktop Services CVE-2026-69525 and Windows DNS Server CVE-2026-69730. Restrict reachability to management networks, enforce MFA where applicable, and validate that no unintended internet exposure exists.

3. Harden email-driven entry paths (Messaging + Endpoint Security): Rapidly deploy Office updates and prioritize Outlook/Word RCEs, including CVE-2026-78509 and CVE-2026-78510. Reinforce attachment/link controls and ensure endpoint protections are enforced on high-risk user groups (finance, exec assistants, IT admins).

4. Assume post-compromise behavior and hunt accordingly (SOC/IR): Because the exploited issues are privilege escalations, hunt for signs of privilege escalation and defense evasion on endpoints—especially around patch deployment windows. Focus on unusual admin token use, unexpected service creation, and suspicious activity on software update/management hosts.

5. Prioritize Windows core services in patch waves (IT Leadership): Given the volume (726 Windows CVEs) and concentration in RCE/EoP, run an accelerated patch cycle for Windows servers providing infrastructure services (DNS/DHCP/RRAS/RDP) and admin endpoints, then broaden to the rest of the fleet with clear maintenance windows and rollback plans.

Technical briefing

Technical Summary

September 2026 Patch Tuesday is an unusually large release: 998 CVEs total, with 45 Critical, 688 High, 240 Medium, 2 Low, and 23 unrated. This is a sharp month-over-month increase from 405 CVEs in August (which had 7 Critical), indicating a broad remediation cycle rather than a narrowly targeted “hot” month. Despite the volume, Microsoft reports 2 CVEs actively exploited in the wild, and 2 CVEs are listed in CISA KEV—both exploited issues with a near-term compliance clock.

Dominant themes are consistent with attacker tradecraft: Elevation of Privilege (438) leads the release, followed by Remote Code Execution (258) and Information Disclosure (173). The critical set is heavily skewed toward network-reachable Windows RCE in core services (DNS/DHCP/RDS/RPC/RRAS/MSMQ/Netlogon), plus identity/cloud authorization failures (Entra ID / Azure AD B2C / Azure AI Language) that can collapse tenant boundaries if abused. What makes this month notable is the combination of (1) two confirmed exploited local EoP primitives useful for post-compromise escalation, and (2) a dense cluster of Critical, unauthenticated network RCEs that are operationally hard to mitigate if the services are exposed internally.

Key finding: The only in-the-wild exploitation this month is local privilege escalation on Windows, but defenders should treat the cluster of unauthenticated Critical Windows service RCEs (DNS/DHCP/RDS/RPC/RRAS/MSMQ/Netlogon) as the most likely next wave for rapid weaponization in enterprise networks.

Critical & Exploited Vulnerabilities

CVE-2026-81963 — Windows Update Stack Elevation of Privilege Vulnerability

This is a High severity but actively exploited local EoP with CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, mapped to CWE-59 (link following) and CWE-284 (access control). The practical scenario is a post-compromise attacker who already has low-privileged local code execution (phishing, drive-by, malicious installer, or foothold via another exploit) and uses filesystem link manipulation to coerce the update stack into writing/reading in a privileged context. In real operations, this is the kind of primitive used to jump from “user” to SYSTEM, then disable EDR, dump credentials, and pivot laterally using stolen tokens and cached secrets.

Status markers: Actively exploited, CISA KEV deadline: 2026-09-22. Affected systems are Windows endpoints and servers where the update stack components are present; the risk is highest on fleets where attackers can land as a standard user (VDI pools, shared workstations, developer endpoints) and then reliably escalate.

CVE-2026-85880 — Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

This is the second actively exploited issue: CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, with memory-safety roots (CWE-122 heap overflow, CWE-908 uninitialized resource). The vector translates cleanly into a common attacker workflow: once code is running locally with low privileges, ALPC becomes a high-value target for reliable privilege escalation because it sits on core Windows IPC paths. Exploitation typically yields SYSTEM or equivalent high integrity execution, enabling credential theft (LSASS access), security control tampering, and persistence via services/scheduled tasks.

Status markers: Actively exploited, CISA KEV deadline: 2026-09-22. Affected products include Windows and ESU. In practice, this pairs naturally with commodity initial access (malicious Office docs, browser exploits, or stolen creds) and is especially dangerous in environments where local admin is restricted—attackers use ALPC-style EoP to bypass that control.

CVE-2026-69525 — Remote Desktop Services Remote Code Execution Vulnerability

A Critical unauthenticated RCE at CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-416 use-after-free). This is the archetypal “wormable candidate” profile: network reachable, no authentication, no user interaction. The realistic prerequisite is simply RDS exposure—either directly to the internet (worst case) or reachable across internal segments (common in enterprise). Weaponization would likely focus on pre-auth service handling paths to gain code execution in the RDS service context, followed by credential harvesting and lateral movement using RDP itself as the transport.

Even without confirmed exploitation, SOC teams should assume rapid attacker interest because RDS is frequently exposed and historically targeted. Prioritize patching where RDS is enabled on servers, jump hosts, and remote access concentrators.

CVE-2026-69730 — Windows DNS Server Remote Code Execution Vulnerability

This Critical DNS Server RCE is CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with CWE-416 use-after-free. The attack scenario is straightforward: an attacker who can send crafted DNS traffic to a vulnerable Windows DNS server can potentially achieve remote code execution in the DNS service. In enterprise networks, DNS servers are high-trust infrastructure; compromise enables follow-on actions like traffic interception, domain-wide service disruption, and stealthy redirection for credential capture (e.g., redirecting internal service names to attacker-controlled hosts).

Operationally, this is high blast-radius: DNS is broadly reachable inside networks, and segmentation is often insufficient. Treat internal exposure as seriously as internet exposure.

CVE-2026-69845 and CVE-2026-72979 — Windows DHCP Server Remote Code Execution Vulnerabilities

These two Critical DHCP Server RCEs (both CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) form a clear pattern: DHCP parsing/handling flaws (one explicitly tied to CWE-122 heap overflow / CWE-20 input validation, the other CWE-416 use-after-free) that can be triggered over the network without authentication. The practical prerequisite is network adjacency to the DHCP server’s reachable interface(s)—which, in many environments, means any host on the same broadcast domain/VLAN or any routed segment where DHCP relay forwards traffic.

Real-world risk is severe because DHCP compromise can be leveraged to (1) gain code execution on a core infrastructure server, and (2) manipulate address assignment and options to facilitate man-in-the-middle, rogue gateway/DNS distribution, or targeted disruption. Even if exploitation is “only” internal, DHCP servers are often domain-joined and become a stepping stone to broader AD compromise.

CVE-2026-69819 — RPC Runtime Library Remote Code Execution Vulnerability

This Critical RPC RCE is CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with CWE-787 out-of-bounds write. RPC is a foundational Windows communication substrate; when RPC runtime is vulnerable, the exposure surface can be wide depending on which services and endpoints are bound and reachable. The concrete scenario is an attacker sending crafted RPC traffic to a reachable endpoint to execute code in a privileged service context, then using that foothold to pivot laterally via SMB/RPC/WinRM and harvest credentials.

From an attacker’s perspective, RPC bugs are valuable because they often apply across many server roles and can be exploited from inside the network after a single beachhead.

CVE-2026-69590 — Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

A Critical RRAS RCE at CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-122 heap overflow). RRAS is commonly deployed on VPN and routing gateways; if exposed, it becomes an attractive edge target. The prerequisite is network reachability to the RRAS service interface—often internet-facing in smaller environments or reachable from partner networks.

Successful exploitation would likely yield code execution on a perimeter system, enabling credential theft, VPN session hijacking, and pivoting into internal networks with “legitimate” routing paths—exactly the kind of compromise pattern that turns a single RCE into a full enterprise incident.

CVE-2026-69431 — Telnet Client Remote Code Execution Vulnerability

This Critical issue is CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-122 heap overflow). While “Telnet Client” sounds legacy, the risk hinges on whether the component is installed and used in automation, troubleshooting, or embedded workflows. The plausible scenario is a user or service initiating a Telnet connection to an attacker-controlled host (or a MITM position), where malicious responses trigger memory corruption leading to code execution in the client context.

In practice, this is less likely to be a mass-exploitation vector than server-side RCEs, but it can be a targeted foothold against admins or automation accounts that still rely on Telnet in constrained environments.

CVE-2026-69463 — Windows NTFS Remote Code Execution Vulnerability

This Critical NTFS RCE is CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-122 heap overflow). The “network” vector here typically maps to scenarios where NTFS parsing is triggered via remote-delivered content—most realistically through malicious disk images/virtual disks, crafted filesystem structures accessed over SMB, or other mechanisms that cause the OS to parse attacker-controlled NTFS metadata.

Real-world weaponization would likely be paired with social engineering or lateral movement: deliver a crafted file/container to a target host, trigger parsing, gain code execution, then escalate privileges and persist.

CVE-2026-69496 — Windows Compressed Folder Remote Code Execution Vulnerability

A Critical compressed folder RCE at CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-122 heap overflow). Although the vector indicates no UI, the practical trigger is typically automatic parsing by Explorer, indexing, preview handlers, or security tooling that inspects archives. Attackers would use this for initial access: deliver a crafted ZIP/Compressed Folder via email, chat, or web download, and rely on background processing to trigger code execution without an explicit “open” action.

This is high-risk in environments with heavy email/attachment workflows and where preview/indexing is enabled broadly.

CVE-2026-69408, CVE-2026-69715, CVE-2026-69491, CVE-2026-70296, CVE-2026-69824, CVE-2026-69586 — Media/Document Rendering RCE Cluster (Media Foundation, DirectShow, DirectMusic, WIC, XPS, Windows PDF)

This cluster represents a common exploitation pattern: memory corruption in parsers/renderers that process attacker-controlled content. Each is Critical at CVSS 9.8 with vectors like CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and CWEs including integer overflow/underflow and heap corruption (CWE-190/191/122/125/787). The realistic scenario is delivery of crafted media or document files (video/audio containers, images, XPS/PDF) through email, web, or internal shares, with triggering via preview handlers, indexing, or application-level rendering pipelines.

Real-world risk is strongest where content is processed automatically (mail gateways that detonate/preview, DLP scanners, thumbnail generation on file servers, collaboration platforms syncing content). Attackers use these bugs to gain code execution in user context, then chain into the actively exploited local EoPs this month to reach SYSTEM.

CVE-2026-69910 — Windows Hyper-V Remote Code Execution Vulnerability

This Critical Hyper-V RCE is CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-121 stack overflow). In practice, Hyper-V RCEs often translate into either (1) remote attack against a management/service interface if exposed, or (2) guest-to-host style compromise depending on the vulnerable component. Either way, the impact is outsized: Hyper-V hosts concentrate workloads, credentials, and management tooling.

If exploited, attackers can pivot from a single compromised VM or reachable interface into the virtualization layer, then tamper with multiple guests, harvest secrets, and disrupt availability at scale.

CVE-2026-72982 — Windows Netlogon Remote Code Execution Vulnerability

A Critical Netlogon RCE at CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-121 stack overflow). Netlogon is tightly coupled with domain authentication flows; if a domain controller or member server exposes a vulnerable Netlogon path, exploitation can lead to code execution in a highly privileged context.

The real-world risk is domain impact: compromise of Netlogon-adjacent services can accelerate to domain dominance, enabling attackers to mint tickets, modify directory objects, and deploy ransomware via GPO or remote service creation.

CVE-2026-69493 — Windows Event Logging Service Remote Code Execution Vulnerability

This Critical service RCE is CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with CWE-125 out-of-bounds read and CWE-122 heap overflow. Event logging is omnipresent and often reachable via management channels; exploitation would provide code execution in a service context that is both privileged and operationally sensitive.

From an attacker standpoint, compromising event logging is doubly valuable: it provides execution and can be used to suppress or manipulate telemetry, complicating incident response and forensics.

CVE-2026-69579 — Windows Message Queuing Remote Code Execution Vulnerability

A Critical MSMQ RCE at CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-416 use-after-free). MSMQ is often forgotten but still present in legacy and line-of-business deployments. If exposed internally, an attacker can send crafted queue messages to trigger code execution on servers that frequently run with elevated privileges and have access to sensitive business workflows.

This is a classic “internal worm” risk in flat networks: once one server is compromised, attackers can scan for MSMQ and propagate.

CVE-2026-73009 — Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability

This Critical SSTP RCE is CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-416 use-after-free). SSTP is used for VPN connectivity; exposure is often internet-facing by design. Exploitation would likely yield code execution on a VPN endpoint, enabling credential interception, session abuse, and direct pivot into internal networks over trusted tunnels.

Given the role of VPN infrastructure in incident chains, this should be treated as a high-priority edge hardening item even without confirmed exploitation.

CVE-2026-73010 — Microsoft Failover Cluster Remote Code Execution Vulnerability

A Critical Failover Cluster RCE at CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CWE-416 use-after-free). Cluster services are typically reachable within server management networks; exploitation would grant code execution on highly privileged infrastructure that often hosts critical workloads (SQL clusters, file services, application tiers).

Attackers value cluster compromise for both impact (availability disruption) and leverage (access to shared storage, service accounts, and management planes).

CVE-2026-68839 — Windows USB Mass Storage Class Driver Remote Code Execution Vulnerability

This Critical driver-level RCE is CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with CWE-122/CWE-20. While the vector is “network,” the practical exploitation pattern for USB mass storage class issues is typically physical or device-adjacent: a malicious USB device (or emulated USB over remote redirection in some environments) triggers kernel-level memory corruption when the driver parses crafted descriptors.

Real-world risk is highest for high-assurance environments (kiosks, OT jump stations, secure admin workstations) where physical access is plausible and where kernel-level execution enables full device takeover.

CVE-2026-73025 — Windows iSCSI Security Feature Bypass Vulnerability

This is a Critical security feature bypass with CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H tied to CWE-1390 weak authentication. The realistic scenario is an attacker who can reach iSCSI targets/initiators and can bypass intended authentication controls, potentially mounting or interacting with storage they should not access. That can translate into data theft, tampering with virtual disks, or staging ransomware by corrupting shared storage.

This is particularly dangerous in virtualization and storage networks where iSCSI is assumed to be “safe because it’s internal.”

CVE-2026-69356 — Microsoft Exchange Server Spoofing Vulnerability

A Critical Exchange spoofing issue at CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N mapped to CWE-79 (XSS). The prerequisite is typically that a user (often an admin or helpdesk operator) interacts with crafted content in an Exchange web context—clicking a link or viewing a message that triggers script execution in the browser under the Exchange origin. The “scope changed” element signals cross-boundary impact: once the attacker can run script in that context, they can steal session tokens, perform actions as the victim, and potentially pivot into administrative functions depending on role and session state.

In real incidents, Exchange web-layer spoofing/XSS is frequently used to move from phishing to authenticated mailbox access, then to internal recon and lateral movement via email-based trust.

CVE-2026-69641 — Microsoft Exchange Server Elevation of Privilege Vulnerability

This Critical Exchange EoP is CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H with CWE-862 missing authorization. The key prerequisite is high privileges already (PR:H), which makes this most relevant for scenarios where an attacker has compromised an Exchange admin account or a delegated administrative role. Once in that position, the authorization flaw can allow actions beyond intended boundaries—potentially crossing tenant/org boundaries or escalating within the Exchange/AD integration surface.

Real-world risk is “post-compromise acceleration”: it turns a stolen admin credential into deeper control, persistence, and broader data access.

CVE-2026-66302 and CVE-2026-78509 and CVE-2026-78510 — Microsoft Office RCEs (Skype for Business, Outlook, Word)

These Office-family issues are all Critical with CVSS 9.8 vectors like CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The practical exploitation story differs by app but converges on a common enterprise risk: attackers deliver crafted content through email and collaboration channels to trigger code execution in a user context, then chain to local EoP (including the two exploited Windows EoPs this month) for full takeover.

• CVE-2026-66302 (Skype for Business, CWE-73 path control) is consistent with crafted payloads that influence file/path handling—useful for dropping/launching attacker-controlled binaries in trusted locations.
• CVE-2026-78509 (Outlook, heap overflow) is particularly operationally relevant because Outlook is a primary ingress vector; “no UI” profiles often map to preview/processing behaviors in mail clients.
• CVE-2026-78510 (Word, heap overflow) remains a staple for targeted phishing and initial access.

CVE-2026-62916, CVE-2026-83941, CVE-2026-83711 — Entra ID / Azure AD B2C Authorization & Authentication Bypass/EoP Cluster

These identity-plane issues are Critical and high-impact because they can undermine the trust fabric used across Microsoft 365/Azure-integrated environments:

• CVE-2026-62916 (Entra ID EoP) is CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N with CWE-288 alternate authentication path—a classic pattern where an attacker can bypass intended auth flows and obtain elevated access without credentials.
• CVE-2026-83941 (Entra ID EoP) is CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L with CWE-862 missing authorization, suggesting a low-privileged identity can perform cross-scope actions.
• CVE-2026-83711 (Azure AD B2C EoP) is CVSS 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N with CWE-639 user-controlled key authorization bypass, a high-risk class where object identifiers/keys can be manipulated to access or modify other users’ resources.

Real-world risk: these are the kinds of bugs that enable tenant data access, privilege escalation to directory roles, token abuse, and persistence via app registrations/service principals. If an attacker can escalate in Entra/AAD, they can often bypass endpoint controls entirely by operating through cloud APIs.

CVE-2026-70352 — Azure AI Language Elevation of Privilege Vulnerability

This is a Critical CVSS 10.0 issue CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H with CWE-306 missing authentication for critical function. The scenario is a remote attacker invoking an AI Language service function that should require authentication but does not, enabling unauthorized actions that can cross security boundaries (scope change). Depending on how the service is integrated, exploitation could expose sensitive data processed by the service, allow tampering with models/configurations, or provide a pivot into connected resources via managed identities or downstream connectors.

This is high priority for organizations embedding Azure AI Language into workflows that touch regulated data or that have privileged integrations into internal systems.

[CVE-2026-69854](https