Microsoft on Thursday released patches for 18 vulnerabilities spanning its Azure cloud portfolio and Copilot-branded AI products.
Elevation of privilege errors accounted for the majority of disclosures and affected Azure ARC, Azure AI Foundry, Azure Logic Apps, Azure Billing, Azure HorizonDB, Azure Cosmos DB, Azure Container Registry, Microsoft Fabric, Microsoft Dataverse, and Microsoft 365 Copilot.
Multiple information disclosure vulnerabilities have been fixed in Copilot, Microsoft 365 Copilot, Microsoft 365 Copilot Business Chat, and Azure Machine Learning. A single spoofing vulnerability has been fixed in the Azure portal.
Microsoft has rated everyone Vulnerabilities as critical, but their CVSS scores indicate high or moderate severity for some.
While some of these flaws were discovered internally by Microsoft, many were reported to the software giant by outside researchers.
None of the vulnerabilities were flagged as exploited, and Microsoft noted that all fixes were implemented server-side, meaning customers do not need to take any action.
Microsoft also announced patches for a Windows privilege escalation vulnerability this week. Users need to update Windows to fix this error CVE-2026-85921but Microsoft believes exploitation is “less likely.”
Like most large companies, Microsoft has seen a surge in vulnerability detections in recent months, fueled by the increasing use of advanced AI. With the latest Patch Tuesday updates, the company has fixed a record-breaking 970 vulnerabilities in its products.
Related: Microsoft commits to comprehensive AI privacy rules for students. Will other tech giants follow?
Related: The Microsoft AI Code of Conduct sets limits on cyberattacks, chains of command, and security restrictions
Related: New zero-day exploit “ShieldCrash” targets Microsoft Defender
