Loading story…
Microsoft disclosed CVE-2026-58275, a critical missing-authorization flaw in Azure DNS that allowed an unauthenticated attacker to elevate privileges over the network. The vulnerability carries a CVSS 3.1 score of 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H and is mapped to CWE-862. Because Azure DNS is a hosted cloud control-plane service, successful exploitation could have enabled unauthorized changes to DNS records, traffic redirection, service disruption, and manipulation of email routing.
Microsoft said the issue was remediated with a service-side fix through the Microsoft Security Update Guide, and no active exploitation had been reported at the time of disclosure. Defenders were urged to review Azure RBAC permissions, audit recent DNS changes, enforce privileged identity protections, and enable logging and alerting for suspicious DNS modifications and role-assignment activity.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Microsoft published CVE-2026-58275 on July 24, 2026 and remediated it with a service-side fix through the Microsoft Security Update Guide. Reporting described the flaw as critical, with potential impacts including unauthorized DNS record changes, traffic redirection, and service disruption.
Microsoft confirmed CVE-2026-58275, a missing authorization vulnerability in Azure DNS that could allow unauthenticated attackers to elevate privileges over the network. The issue was described as affecting the Azure DNS hosted service and requiring no user interaction.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has published a cluster of DNS-related security advisories covering **remote code execution, denial of service, cache poisoning, heap overflow, and access-control bypass** conditions across Windows DNS Server and third-party DNS components. The newly listed issues include `CVE-2026-33278` for possible arbitrary code execution during **DNSSEC** validation, `CVE-2026-42959` for crashes triggered by malicious DNSSEC content, `CVE-2026-42960` for possible cache poisoning through promiscuous authority-section records, and `CVE-2026-42944` for a heap overflow involving multiple `NSID`, `COOKIE`, and `PADDING` **EDNS** options. Additional advisories describe degradation-of-service conditions tied to long EDNS option lists (`CVE-2026-41292`), unbounded name compression (`CVE-2026-44390`), and a "packet of death" affecting **DNSCrypt** (`CVE-2026-32792`). The disclosures also reference flaws in widely used DNS software, including a **BIND 9** resolver unbounded resend loop (`CVE-2026-5950`), invalid handling of `CLASS != IN` (`CVE-2026-5946`), and a **CoreDNS** ACL bypass (`CVE-2026-26017`). Earlier Microsoft advisories for Windows DNS Server remote code execution, including `CVE-2021-33754` and `CVE-2021-33746`, show that DNS services remain a recurring high-impact target because they are network-exposed and central to enterprise operations. For defenders, the combined set of advisories highlights the need to prioritize patching DNS infrastructure, review exposure of DNSSEC, EDNS, and DNSCrypt features, and monitor for service instability or anomalous DNS responses that could indicate exploitation attempts.
Jun 29, 2026
Microsoft has published multiple Security Update Guide entries for elevation-of-privilege vulnerabilities affecting cloud services including **Azure Resource Manager**, **Azure Entra ID**, **Azure AI Foundry**, and **Redis Enterprise**. The disclosed issues include `CVE-2026-47280` and `CVE-2026-24304` in Azure Resource Manager, `CVE-2026-24305` and `CVE-2025-55241` in Azure Entra ID, `CVE-2025-59271` in Redis Enterprise, and `CVE-2026-35435` in Azure AI Foundry, indicating a broader set of privilege-boundary weaknesses across Microsoft-managed platforms. Microsoft provided the most detail for **CVE-2026-35435**, describing it as a **critical** improper access control flaw in Azure AI Foundry M365 published agents that could be exploited remotely over the network without privileges or user interaction, with potential for high confidentiality impact. The company said exploitation was considered more likely, but the vulnerability had not been publicly disclosed or exploited at publication time, and the service-side issue was already fully mitigated with **no customer action required**; the remaining CVEs were listed with limited public detail in the update guide.
Jun 29, 2026
Microsoft disclosed multiple **privilege escalation** vulnerabilities in core enterprise products, including **Active Directory Domain Services** and **SQL Server**, with public reporting highlighting network-reachable attack paths that require only authenticated or otherwise authorized access. **CVE-2026-25177** affects AD DS and was described as an elevation-of-privilege issue tied to improper restriction of file and resource names, enabling abuse of crafted Unicode characters to create duplicate `SPN` or `UPN` values. Reporting indicates this can interfere with Kerberos ticket handling, potentially causing denial of service, triggering fallback to **NTLM** where enabled, and ultimately enabling escalation to **SYSTEM**-level control in affected environments. Microsoft also disclosed **CVE-2026-21262** in **SQL Server**, an **Important**-rated flaw with a **CVSS 8.8** score that allows an authenticated attacker to elevate privileges to `sysadmin`, giving full control over the database instance. Public reporting said Microsoft assessed exploitation as **less likely** and had not observed active in-the-wild abuse at disclosure time, but noted the issue was publicly disclosed, increasing the risk of follow-on exploit development. Other referenced items about **ADCS ESC1**, **Cisco SD-WAN Manager**, and **n8n** concern separate products and unrelated vulnerabilities, while the standalone MSRC entry does not provide enough detail in the supplied content to confirm it is part of the same specific event.
Jun 29, 2026