# Microsoft September 2026 Cloud Disclosure: 18 Elevation-of-Privilege, Information-Disclosure, and Spoofing Flaws Across Azure and Copilot AI Products, Plus a Windows Secure Kernel EoP (CVE-2026-85921)

> On September 17-18, 2026, Microsoft disclosed a batch of 18 vulnerabilities spanning Azure infrastructure services (Arc, AI Foundry, Logic Apps, Billing, HorizonDB/PostgreSQL, Cosmos DB, Container Registry), Microsoft Fabric, Microsoft Dataverse, and Copilot AI products (Microsoft Copilot, Microsoft 365 Copilot, Copilot Business Chat, Azure Machine Learning, Azure Portal) - mostly elevation-of-privilege, plus information disclosure and one spoofing flaw. A separately flagged Windows Secure Kernel Mode double-free elevation-of-privilege bug (CVE-2026-85921) was published in the same window and required a client-side update. None of the 19 vulnerabilities has been exploited in the wild or has a public proof-of-concept; all 18 cloud-service fixes were applied server-side with no customer action.

- **Published:** 2026-09-18T00:00:00Z
- **Last reviewed:** 2026-09-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2563
- **ID:** TL-2026-2563
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-85921, CVE-2026-69399, CVE-2026-70009, CVE-2026-85917, CVE-2026-85889, CVE-2026-83944, CVE-2026-62874, CVE-2026-85878, CVE-2026-87701, CVE-2026-69865, CVE-2026-69843, CVE-2026-70178, CVE-2026-77903, CVE-2026-41106, CVE-2026-47645, CVE-2026-55946, CVE-2026-85887, CVE-2026-68791, CVE-2026-83946

## Description

Microsoft's Security Response Center (MSRC) published a dense cluster of CVEs on September 17, 2026, one day ahead of SecurityWeek's roundup coverage, covering the Azure and Microsoft 365 Copilot AI surface. The majority of the disclosures (at least 15 of the 18) are elevation-of-privilege vulnerabilities: two in Azure Arc (CVE-2026-69399, CVE-2026-70009, both improper-authorization issues), two in Azure AI Foundry (CVE-2026-85917, a server-side request forgery, and CVE-2026-85889, a missing-authentication-for-critical-function flaw - both exploitable by an unauthorized network attacker against the AI Foundry control plane), one in Azure Logic Apps (CVE-2026-83944, improper access control rated CVSS 10.0), one in Azure Billing (CVE-2026-62874, insufficient verification of data authenticity), one in Azure HorizonDB / Azure Database for PostgreSQL (CVE-2026-85878, improper authorization, CVSS ~9.9), one in Azure Cosmos DB (CVE-2026-87701), one in Azure Container Registry (CVE-2026-69865, an authorization bypass through a user-controlled key, CVSS 10.0, remotely exploitable pre-auth), two in Microsoft Fabric (CVE-2026-69843, authentication bypass by spoofing, and CVE-2026-70178, missing authorization), one in Microsoft Dataverse (CVE-2026-77903), and two open-redirect elevation-of-privilege bugs in Microsoft 365 Copilot (CVE-2026-41106) and its Business Chat feature (CVE-2026-47645) that require a victim to follow a crafted link. Information-disclosure flaws were fixed in Microsoft Copilot (CVE-2026-55946, a command-injection issue), Microsoft 365 Copilot (CVE-2026-85887, incorrect permission assignment for a critical resource - both capable of leaking a user's connected emails, Teams chats, Word documents, and SharePoint content given Copilot's deep tenant integration), and Azure Machine Learning (CVE-2026-68791, incorrect authorization / CWE-863, letting an unauthenticated caller send crafted requests manipulating workspace IDs, project names, or model identifiers to pull back sensitive workspace data). One spoofing vulnerability was fixed in Azure Portal (CVE-2026-83946, a stored cross-site-scripting flaw, CWE-79, CVSS 8.2, that could let an attacker manipulate the portal UI or steal authenticated session tokens). Separately, and not counted in the '18,' Microsoft published CVE-2026-85921, a Critical Windows Secure Kernel Mode elevation-of-privilege vulnerability caused by a double free (CWE-415) that lets a locally authorized attacker escalate to Virtual Trust Level 1 (VTL1) - the hardware-backed security boundary Windows uses to isolate credential material and kernel integrity checks from a compromised normal-mode OS. Unlike the cloud-service fixes, CVE-2026-85921 required customers to install a client-side update (Microsoft shipped it via the out-of-band KB5129194 cumulative update for Windows 11 26H1, OS Build 28000.2956, released September 14, 2026). Microsoft internally rates all 18 cloud-service CVEs as 'Critical' by its own severity taxonomy even though third-party CVSS recalculations put several in the high-to-medium band; none of the 19 vulnerabilities in this batch has been observed exploited in the wild, has known public exploit code, or appears on the CISA Known Exploited Vulnerabilities catalog, and Microsoft assesses exploitation of CVE-2026-85921 specifically as 'less likely.' The disclosure lands the same week MSRC's blog announced it is expanding machine-readable Vulnerability Exploitability eXchange (VEX) statements to all Microsoft-assigned CVEs, part of its 'Toward Greater Transparency' cloud-service-CVE program, under which server-side-only fixes for multi-tenant cloud products are now routinely assigned and published CVEs even though customers take no remediation action themselves.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1204.001 Malicious Link
- T1059.007 JavaScript
- T1078.004 Cloud Accounts
- T1550 Use Alternate Authentication Material
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1580 Cloud Infrastructure Discovery
- T1213 Data from Information Repositories
- T1119 Automated Collection

## Sources

- [Microsoft Patches 18 Vulnerabilities in AI, Cloud Products](https://www.securityweek.com/microsoft-patches-18-vulnerabilities-in-ai-cloud-products/)
- [CVE-2026-85921 - Windows Secure Kernel Mode Elevation of Privilege Vulnerability (MSRC Advisory)](https://msrc.microsoft.com/update-guide/advisory/CVE-2026-85921)
- [September 14, 2026-KB5129194 (OS Build 28000.2956) Out-of-band](https://support.microsoft.com/en-us/servicing/os/windows-11/2026/09/kb5129194-windows-11-26h1-security-update)
- [CVE-2026-85917 Azure AI Foundry Elevation of Privilege Vulnerability](https://thewindowsupdate.com/2026/09/17/cve-2026-85917-azure-ai-foundry-elevation-of-privilege-vulnerability/)
- [CVE-2026-85889 Azure AI Foundry Elevation of Privilege Vulnerability](https://thewindowsupdate.com/2026/09/17/cve-2026-85889-azure-ai-foundry-elevation-of-privilege-vulnerability/)
- [CVE-2026-85878 Azure Database for PostgreSQL Elevation of Privilege Vulnerability](https://thewindowsupdate.com/2026/09/17/cve-2026-85878-azure-database-for-postgresql-elevation-of-privilege-vulnerability/)
- [CVE-2026-69843 Microsoft Fabric Elevation of Privilege Vulnerability](https://thewindowsupdate.com/2026/09/17/cve-2026-69843-microsoft-fabric-elevation-of-privilege-vulnerability/)
- [CVE-2026-62874 Azure Billing Elevation of Privilege Vulnerability](https://thewindowsupdate.com/2026/09/17/cve-2026-62874-azure-billing-elevation-of-privilege-vulnerability/)
- [CVE-2026-55946 Microsoft Copilot Information Disclosure Vulnerability](https://thewindowsupdate.com/2026/09/17/cve-2026-55946-microsoft-copilot-information-disclosure-vulnerability/)
- [CVE-2026-85887 M365 Copilot Information Disclosure Vulnerability](https://thewindowsupdate.com/2026/09/17/cve-2026-85887-m365-copilot-information-disclosure-vulnerability/)
- [CVE-2026-83946 Azure Portal Spoofing Vulnerability](https://thewindowsupdate.com/2026/09/17/cve-2026-83946-azure-portal-spoofing-vulnerability/)
- [CVE-2026-69865: Azure Container Registry Vulnerability (CVSS 10)](https://www.strix.ai/cve/CVE-2026-69865)
- [CVE-2026-83946: Azure Portal XSS (CVSS 8.2) - Fix & Details](https://www.strix.ai/cve/CVE-2026-83946)
- [CVE-2026-68791: Azure Machine Learning Incorrect Authorization](https://www.strix.ai/cve/CVE-2026-68791)
- [CVE-2026-68791: CWE-863 Incorrect Authorization in Microsoft Azure Machine Learning](https://radar.offseq.com/threat/cve-2026-68791-cwe-863-incorrect-authorization-in-microsoft-azure-machine-learning-d85eed00679f9da1)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2563