Microsoft September 2026 Cloud Disclosure: 18 Elevation-of-Privilege, Information-Disclosure, and Spoofing Flaws Across Azure and Copilot AI Products, Plus a Windows Secure Kernel EoP (CVE-2026-85921)

Key facts for Microsoft Cloud Disclosure

Detection coverage for Microsoft Cloud Disclosure

As of 2026-09-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2563 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Azure Container Registry User-Controlled-Key Authorization Bypass → Cross-Tenant Image Pull (CVE-2026-69865)

Detects a single caller pulling or pushing images across an unusually broad set of repositories in a short window, consistent with exploitation of CVE-2026-69865 (authorization bypass through a user-controlled key, CVSS 10.0, remotely exploitable pre-auth), which an attacker could use to enumerate and pull images from repositories outside their authorized tenant as a lateral-movement / valid-accounts pivot.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1078.004, T1550, T1580
• Data sources: azure_container_registry_logs, azure_activity_logs
• Severity: critical
• Confidence: medium

Splunk SPL

index=azure sourcetype="azure:diagnostics" ResourceProvider="MICROSOFT.CONTAINERREGISTRY" (OperationName="Pull" OR OperationName="Push" OR category="ContainerRegistryLoginEvents")
| eval cross_tenant=if(isnotnull(Identity) AND NOT match(Identity, "expectedTenantId"), 1, 0)
| stats count dc(Repository) as repo_count values(Repository) as repos min(_time) as first_seen max(_time) as last_seen by CallerIpAddress, Identity
| where repo_count >= 3 AND count >= 10

Microsoft KQL

ContainerRegistryRepositoryEvents
| where TimeGenerated > ago(24h)
| where OperationName in ("Pull", "Push")
| summarize PullCount = count(), Repos = dcount(Repository), RepoList = make_set(Repository, 20) by CallerIpAddress, Identity, bin(TimeGenerated, 1h)
| where Repos >= 3 and PullCount >= 10

Sigma

title: Azure Container Registry User-Controlled-Key Authorization Bypass Exploitation (CVE-2026-69865)
id: c3d4e5f6-3333-4c3d-9e4f-333333333333
status: experimental
description: Detects a caller identity pulling or pushing across an anomalously broad set of Azure Container Registry repositories in a short window, consistent with pre-auth exploitation of CVE-2026-69865 to access repositories outside the caller's authorized scope via a user-controlled key.
references:
    - https://www.strix.ai/cve/CVE-2026-69865
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-18
tags:
    - attack.privilege-escalation
    - attack.t1078.004
    - attack.defense-evasion
    - attack.t1550
    - attack.discovery
    - attack.t1580
    - cve.2026.69865
logsource:
    category: application
    product: azure
    service: containerregistry
detection:
    selection_op:
        OperationName:
            - 'Pull'
            - 'Push'
    condition: selection_op | count(distinct Repository) by CallerIpAddress > 2
falsepositives:
    - CI/CD build pipelines that legitimately pull/push across many repositories from a shared build-agent IP
    - Registry replication/geo-sync jobs
level: high

Known false positives:

• Legitimate CI/CD build pipelines or registry replication jobs touching many repositories from a shared IP

Tuning notes: Baseline known CI/CD service-principal identities and build-agent IP ranges as an allow-list exclusion; raise the repo_count threshold in environments with legitimate multi-repo automation.

• 🔒 Azure Portal Stored XSS / UI Spoofing → Anomalous Session Reuse (CVE-2026-83946) · unlock with TL Creds
• 🔒 Copilot Open-Redirect Phishing → Mass Tenant-Data Collection (CVE-2026-41106, CVE-2026-47645, CVE-2026-55946, CVE-2026-85887) · unlock with TL Creds
• 🔒 Post-SSRF Cloud Infrastructure Discovery & Valid-Account Pivot Across Azure Control-Plane Services · unlock with TL Creds
• 🔒 Azure Machine Learning Unauthenticated Workspace/Model Enumeration (CVE-2026-68791) · unlock with TL Creds
• 🔒 Cross-Provider Improper Access-Control Privilege Escalation Across Azure Platform Services · unlock with TL Creds
• 🔒 Microsoft Copilot Command-Injection Leading to Script Execution and Session-Cookie Theft (CVE-2026-55946) · unlock with TL Creds
• 🔒 Azure AI Foundry SSRF / Missing-Auth Control-Plane Abuse (CVE-2026-85917, CVE-2026-85889) · unlock with TL Creds
• 🔒 Windows Secure Kernel Double-Free / VTL1 Escalation Attempt Pre-KB5129194 (CVE-2026-85921) · unlock with TL Creds

Indicators of compromise for Microsoft Cloud Disclosure

As of 2026-09-18, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-2563.

How Microsoft Cloud Disclosure works

A separately flagged Windows Secure Kernel Mode double-free elevation-of-privilege bug (CVE-2026-85921) was published in the same window and required a client-side update. None of the 19 vulnerabilities has been exploited in the wild or has a public proof-of-concept; all 18 cloud-service fixes were applied server-side with no customer action.

Microsoft's Security Response Center (MSRC) published a dense cluster of CVEs on September 17, 2026, one day ahead of SecurityWeek's roundup coverage, covering the Azure and Microsoft 365 Copilot AI surface. The majority of the disclosures (at least 15 of the 18) are elevation-of-privilege vulnerabilities: two in Azure Arc (CVE-2026-69399, CVE-2026-70009, both improper-authorization issues), two in Azure AI Foundry (CVE-2026-85917, a server-side request forgery, and CVE-2026-85889, a missing-authentication-for-critical-function flaw - both exploitable by an unauthorized network attacker against the AI Foundry control plane), one in Azure Logic Apps (CVE-2026-83944, improper access control rated CVSS 10.0), one in Azure Billing (CVE-2026-62874, insufficient verification of data authenticity), one in Azure HorizonDB / Azure Database for PostgreSQL (CVE-2026-85878, improper authorization, CVSS ~9.9), one in Azure Cosmos DB (CVE-2026-87701), one in Azure Container Registry (CVE-2026-69865, an authorization bypass through a user-controlled key, CVSS 10.0, remotely exploitable pre-auth), two in Microsoft Fabric (CVE-2026-69843, authentication bypass by spoofing, and CVE-2026-70178, missing authorization), one in Microsoft Dataverse (CVE-2026-77903), and two open-redirect elevation-of-privilege bugs in Microsoft 365 Copilot (CVE-2026-41106) and its Business Chat feature (CVE-2026-47645) that require a victim to follow a crafted link. Information-disclosure flaws were fixed in Microsoft Copilot (CVE-2026-55946, a command-injection issue), Microsoft 365 Copilot (CVE-2026-85887, incorrect permission assignment for a critical resource - both capable of leaking a user's connected emails, Teams chats, Word documents, and SharePoint content given Copilot's deep tenant integration), and Azure Machine Learning (CVE-2026-68791, incorrect authorization / CWE-863, letting an unauthenticated caller send crafted requests manipulating workspace IDs, project names, or model identifiers to pull back sensitive workspace data). One spoofing vulnerability was fixed in Azure Portal (CVE-2026-83946, a stored cross-site-scripting flaw, CWE-79, CVSS 8.2, that could let an attacker manipulate the portal UI or steal authenticated session tokens). Separately, and not counted in the '18,' Microsoft published CVE-2026-85921, a Critical Windows Secure Kernel Mode elevation-of-privilege vulnerability caused by a double free (CWE-415) that lets a locally authorized attacker escalate to Virtual Trust Level 1 (VTL1) - the hardware-backed security boundary Windows uses to isolate credential material and kernel integrity checks from a compromised normal-mode OS. Unlike the cloud-service fixes, CVE-2026-85921 required customers to install a client-side update (Microsoft shipped it via the out-of-band KB5129194 cumulative update for Windows 11 26H1, OS Build 28000.2956, released September 14, 2026). Microsoft internally rates all 18 cloud-service CVEs as 'Critical' by its own severity taxonomy even though third-party CVSS recalculations put several in the high-to-medium band; none of the 19 vulnerabilities in this batch has been observed exploited in the wild, has known public exploit code, or appears on the CISA Known Exploited Vulnerabilities catalog, and Microsoft assesses exploitation of CVE-2026-85921 specifically as 'less likely.' The disclosure lands the same week MSRC's blog announced it is expanding machine-readable Vulnerability Exploitability eXchange (VEX) statements to all Microsoft-assigned CVEs, part of its 'Toward Greater Transparency' cloud-service-CVE program, under which server-side-only fixes for multi-tenant cloud products are now routinely assigned and published CVEs even though customers take no remediation action themselves.

MITRE ATT&CK techniques by tactic:

Execution

T1059.007 JavaScript; T1204.001 Malicious Link

Privilege Escalation

T1078.004 Cloud Accounts

Collection

T1119 Automated Collection; T1213 Data from Information Repositories

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1539 Steal Web Session Cookie; T1552 Unsecured Credentials

lateral-movement

T1550 Use Alternate Authentication Material

Discovery

T1580 Cloud Infrastructure Discovery

Remediation for Microsoft Cloud Disclosure

Patches

• KB5129194 (Windows 11 26H1, OS Build 28000.2956) - out-of-band, remediates CVE-2026-85921
• Server-side Microsoft fixes (no customer package/version to apply) for CVE-2026-69399, CVE-2026-70009 (Azure Arc), CVE-2026-85917, CVE-2026-85889 (Azure AI Foundry), CVE-2026-83944 (Azure Logic Apps), CVE-2026-62874 (Azure Billing), CVE-2026-85878 (Azure HorizonDB/Azure Database for PostgreSQL), CVE-2026-87701 (Azure Cosmos DB), CVE-2026-69865 (Azure Container Registry), CVE-2026-69843, CVE-2026-70178 (Microsoft Fabric), CVE-2026-77903 (Microsoft Dataverse), CVE-2026-41106 (Microsoft 365 Copilot), CVE-2026-47645 (Copilot Business Chat), CVE-2026-55946 (Microsoft Copilot), CVE-2026-85887 (Microsoft 365 Copilot), CVE-2026-68791 (Azure Machine Learning), CVE-2026-83946 (Azure Portal)

Immediate actions

• Confirm tenant-level exposure is closed: the 18 Azure/Copilot fixes were applied server-side by Microsoft and require no customer action, but verify via the Azure Service Health / Microsoft 365 Message Center that the relevant service updates have rolled out to your tenant's region.
• Install the out-of-band Windows update KB5129194 (OS Build 28000.2956) on all Windows 11 26H1 endpoints to remediate CVE-2026-85921.
• Audit Azure AI Foundry, Azure Container Registry, and Azure Cosmos DB access logs for anomalous unauthenticated or cross-tenant requests predating the September 17, 2026 patch, since several of the flaws (SSRF, missing authentication, user-controlled-key authorization bypass) were remotely exploitable pre-auth.
• Review Microsoft 365 Copilot and Copilot Business Chat sign-in/redirect logs for unexpected external redirect targets that could indicate open-redirect abuse tied to CVE-2026-41106 / CVE-2026-47645.

Workarounds

• None published or required for the 18 cloud-service CVEs; Microsoft states the fixes are fully deployed server-side.
• For CVE-2026-85921, defense-in-depth prior to patching includes restricting local logon rights on affected Windows 11 26H1 hosts, since exploitation requires local, authorized access.

Longer-term hardening

• Subscribe to Microsoft's expanded VEX (Vulnerability Exploitability eXchange) machine-readable feed to automate cloud-service-CVE exposure tracking rather than relying on manual Patch Tuesday review.
• Extend vulnerability-management scope to explicitly cover PaaS/SaaS control-plane services (AI Foundry, Fabric, Dataverse, Cosmos DB, Container Registry) that receive CVEs but never appear in traditional endpoint patch compliance tooling.
• Implement DLP and audit logging specifically for Copilot data-access paths (email, Teams, SharePoint, Word) given the recurring pattern of Copilot information-disclosure CVEs.
• Harden Azure AI Foundry outbound network policies to reduce SSRF blast radius from control-plane services with broad internal network reach.

Affected and fixed versions

• Microsoft — Windows 11 26H1
  Vulnerable versions: OS Build 28000.x prior to 28000.2956
  Fixed in: OS Build 28000.2956 via KB5129194
• Microsoft — Azure Arc
  Vulnerable versions: cloud service - all tenants prior to Sept 17, 2026 server-side fix
  Fixed in: server-side patched, no customer action
• Microsoft — Azure AI Foundry
  Vulnerable versions: cloud service - all tenants prior to Sept 17, 2026 server-side fix
  Fixed in: server-side patched, no customer action
• Microsoft — Azure Logic Apps
  Vulnerable versions: cloud service - all tenants prior to Sept 17, 2026 server-side fix
  Fixed in: server-side patched, no customer action
• Microsoft — Azure Billing
  Vulnerable versions: cloud service - all tenants prior to Sept 17, 2026 server-side fix
  Fixed in: server-side patched, no customer action
• Microsoft — Azure HorizonDB / Azure Database for PostgreSQL
  Vulnerable versions: cloud service - all tenants prior to Sept 17, 2026 server-side fix
  Fixed in: server-side patched, no customer action
• Microsoft — Azure Cosmos DB
  Vulnerable versions: cloud service - all tenants prior to Sept 17, 2026 server-side fix
  Fixed in: server-side patched, no customer action
• Microsoft — Azure Container Registry
  Vulnerable versions: cloud service - all tenants prior to Sept 17, 2026 server-side fix
  Fixed in: server-side patched, no customer action
• Microsoft — Microsoft Fabric
  Vulnerable versions: cloud service - all tenants prior to Sept 17, 2026 server-side fix
  Fixed in: server-side patched, no customer action
• Microsoft — Microsoft Dataverse
  Vulnerable versions: cloud service - all tenants prior to Sept 17, 2026 server-side fix
  Fixed in: server-side patched, no customer action

Timeline of Microsoft Cloud Disclosure

• 2026-09-14 locked-ioc-16 ships KB5129194, an out-of-band Windows 11 26H1 (OS Build 28000.2956) cumulative update, ahead of the main September servicing cycle.
• 2026-09-15 MSRC publishes CVE-2026-85921, a Critical Windows Secure Kernel Mode double-free elevation-of-privilege vulnerability (CWE-415) allowing a locally authorized attacker to obtain Virtual Trust Level 1 (VTL1) privileges; locked-ioc-16 rates exploitation 'less likely' and confirms no public disclosure or in-the-wild exploitation.
• 2026-09-17 MSRC publishes a blog post expanding machine-readable Vulnerability Exploitability eXchange (VEX) statements to all Microsoft-assigned CVEs, the same 'Toward Greater Transparency' program under which the server-side-only Azure/Copilot CVEs in this batch are disclosed.
• 2026-09-17 locked-ioc-16 discloses an locked-ioc-5 information-disclosure flaw (CVE-2026-68791, incorrect authorization, CWE-863) and an locked-ioc-14 spoofing vulnerability (CVE-2026-83946, stored cross-site scripting, CWE-79, CVSS 8.2).
• 2026-09-17 locked-ioc-16 discloses information-disclosure flaws in locked-ioc-8 (CVE-2026-55946, command injection) and locked-ioc-6 (CVE-2026-85887, incorrect permission assignment for a critical resource), both capable of leaking tenant email, Teams, and SharePoint content given Copilot's deep data integration.
• 2026-09-17 locked-ioc-16 discloses open-redirect elevation-of-privilege vulnerabilities in locked-ioc-6 (CVE-2026-41106) and its Business Chat feature (CVE-2026-47645), both fully mitigated server-side with no customer action.
• 2026-09-17 locked-ioc-16 discloses elevation-of-privilege issues in locked-ioc-10 (CVE-2026-83944, improper access control, CVSS 10.0), locked-ioc-13 (CVE-2026-62874), locked-ioc-11 (CVE-2026-69843 authentication bypass by spoofing; CVE-2026-70178 missing authorization), and locked-ioc-7 (CVE-2026-77903).
• 2026-09-17 locked-ioc-16 discloses elevation-of-privilege flaws in locked-ioc-12 (CVE-2026-87701), Azure HorizonDB/Azure Database for PostgreSQL (CVE-2026-85878), locked-ioc-4 (CVE-2026-69865, authorization bypass via a user-controlled key), and locked-ioc-15 (CVE-2026-69399, CVE-2026-70009).
• 2026-09-17 locked-ioc-16 discloses two locked-ioc-9 elevation-of-privilege vulnerabilities: CVE-2026-85917 (server-side request forgery) and CVE-2026-85889 (missing authentication for a critical function), both exploitable by an unauthorized network attacker against the AI Foundry control plane.
• 2026-09-18 SecurityWeek publishes 'locked-ioc-16 Patches 18 Vulnerabilities in AI, Cloud Products,' summarizing the batch of 18 Azure/Copilot fixes plus the separately flagged Windows kernel flaw, and confirms all server-side fixes required no customer action and none of the 18 were flagged as exploited in the wild.

Sources cited for Microsoft Cloud Disclosure

Showing 15 of 18 sources, primary sources first.

• CVE-2026-85921 - Windows Secure Kernel Mode Elevation of Privilege Vulnerability (MSRC Advisory) Microsoft Security Response Center · Advisory · 2026-09-15
• CVE-2026-41106 - Microsoft 365 Copilot Elevation of Privilege Vulnerability (MSRC) Microsoft Security Response Center · Advisory · 2026-09-17
• CVE-2026-47645 - Microsoft 365 Copilot's Business Chat Elevation of Privilege Vulnerability (MSRC) Microsoft Security Response Center · Advisory · 2026-09-17
• September 14, 2026-KB5129194 (OS Build 28000.2956) Out-of-band Microsoft · Vendor report · 2026-09-14
• CVE-2026-85917 Azure AI Foundry Elevation of Privilege Vulnerability thewindowsupdate.com · Vendor report · 2026-09-17
• CVE-2026-85889 Azure AI Foundry Elevation of Privilege Vulnerability thewindowsupdate.com · Vendor report · 2026-09-17
• CVE-2026-85878 Azure Database for PostgreSQL Elevation of Privilege Vulnerability thewindowsupdate.com · Vendor report · 2026-09-17
• CVE-2026-69843 Microsoft Fabric Elevation of Privilege Vulnerability thewindowsupdate.com · Vendor report · 2026-09-17
• CVE-2026-62874 Azure Billing Elevation of Privilege Vulnerability thewindowsupdate.com · Vendor report · 2026-09-17
• CVE-2026-55946 Microsoft Copilot Information Disclosure Vulnerability thewindowsupdate.com · Vendor report · 2026-09-17
• CVE-2026-85887 M365 Copilot Information Disclosure Vulnerability thewindowsupdate.com · Vendor report · 2026-09-17
• CVE-2026-83946 Azure Portal Spoofing Vulnerability thewindowsupdate.com · Vendor report · 2026-09-17
• CVE-2026-69865: Azure Container Registry Vulnerability (CVSS 10) strix.ai · Research · 2026-09-17
• CVE-2026-83946: Azure Portal XSS (CVSS 8.2) - Fix & Details strix.ai · Research · 2026-09-17
• CVE-2026-68791: Azure Machine Learning Incorrect Authorization strix.ai · Research · 2026-09-17

More in vulnerability

• Siemens SSA-698820: Multiple Fortigate NGFW Vulnerabilities (before V7.4.4) on RUGGEDCOM APE1808 Devices
• Siemens SSA-827968: Multiple Vulnerabilities in Nozomi Guardian/CMC < V26.2.0 on RUGGEDCOM APE1808 (17 CVEs)
• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)
• Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)

Previous and next in vulnerability

• AI-Driven Exploit Chain Against OpenAI Community Forum via libheif Flaw (CVE-2026-32882) Previous report
• AI-Built Exploit Chain Turns Unpatched libheif Flaw and OpenAI Forum Sign-In Bug into Internal Code Access Next report