Public security advisories
Current vulnerabilities, known exploitation, Microsoft security updates, and practical guidance from Griffin Technology Partners.
Primary sources
Microsoft Security Response Center
CISA Known Exploited Vulnerabilities
Vulnerability intelligence
Last collection: October 9, 2026
Six-hour refresh · Public-source information only
571 bulletins · Page 19 of 24
JSON feedImproper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
Affected: Azure SQL Database
Updated
'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
Affected: Microsoft Entra Provisioning Service
Updated
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
Affected: Azure SRE Agent
Updated
Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network.
Affected: Azure SQL Managed Instance
Updated
Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network.
Affected: Microsoft Entra ID
Updated
Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.
Affected: Microsoft 365 Admin Center
Updated
Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
Affected: Microsoft Teams
Updated
Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.
Affected: Microsoft Teams
Updated
Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally.
Affected: Azure SQL Database
Updated
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
Affected: Microsoft Teams
Updated
Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.
Affected: Microsoft Purview eDiscovery
Updated
Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.
Affected: Azure Confidential Ledger
Updated
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Affected: Microsoft SharePoint Online
Updated
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Affected: Microsoft 365 Apps for Enterprise for 32-bit Systems · Microsoft 365 Apps for Enterprise for 64-bit Systems · +11 more
Updated
Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
Affected: Azure Cosmos DB
Updated
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
Affected: Windows 10 Version 1607 for 32-bit Systems · Windows 10 Version 1607 for x64-based Systems · +13 more
Updated
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.
Affected: Microsoft Edge Copilot for Android · Microsoft Edge Copilot for IOS
Updated
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.
Affected: Azure Portal
Updated
Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network.
Affected: Azure API Management (APIM)
Updated
Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network.
Affected: Microsoft Graph
Updated
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.
Affected: Microsoft 365 Copilot
Updated
Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network.
Affected: Surface Management Services
Updated
Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.
Affected: Azure Red Hat OpenShift (ARO)
Updated
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
Affected: Azure Kubernetes Service
Updated
The collection starts with 90 days of Microsoft updates and CISA additions, plus older Microsoft vulnerabilities still listed by CISA. Older entries do not imply that a product remains supported. Counts describe this collection, not every vulnerability or any customer environment.
Last successful check: October 9, 2026
Last successful check: October 9, 2026
Griffin Technology Partners managed customers may receive additional environment-specific security guidance and remediation assistance through their managed services relationship.
Security bulletins are provided for informational purposes and compiled from authoritative public sources. Vulnerability applicability varies by environment. Validate affected products, configuration, compatibility requirements, and vendor guidance before making production changes.
