Microsoft and Apple Rush Out Patches for Flaws That Let Attackers In Without a Password
Several of the Microsoft bugs score a perfect 10 out of 10 for severity. Apple quietly fixed a flaw that lets someone access your screen without logging in.
Key points
- Microsoft patched more than a dozen security flaws on 6 August 2026, including three rated the maximum possible severity of 10 out of 10.
- The three perfect-score flaws affect Planetary Computer Pro, Azure SQL Database, and Microsoft Teams, and all can be exploited remotely over a network without valid credentials.
- Four additional flaws scored 9.9 out of 10, affecting Azure Service Bus, Azure SRE Agent, Microsoft Entra (the company's identity management service), and Active Directory.
- Apple patched CVE-2026-65400, rated 7.5 out of 10, which lets an attacker on the same network access another computer's screen without a valid username or password.
- Apple's fix shipped in three macOS updates: macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, and macOS Sonoma 14.8.9.
What actually happened here?
Microsoft and Apple each shipped security patches on 6 August 2026, closing gaps that let attackers in without a password, as first reported by SecurityWeek. Both drops landed within weeks of earlier rounds: Apple's 28 July update covered 87 iOS flaws and 155 in macOS Tahoe, and Microsoft's Azure Cosmos DB patch on 30 July closed a sandbox-escape chain that exposed customer database master keys.
Microsoft's list is the longer one. Three vulnerabilities, security flaws that let attackers do something they shouldn't be able to do, carry a 10 out of 10 on the CVSS scale, the industry's standard severity scorecard. All three involve missing or broken authentication: the software doesn't check whether the person asking for access is allowed there.
| CVE ID | Product | What the flaw does | CVSS Score |
|---|---|---|---|
| CVE-2026-63508 | Planetary Computer Pro | Missing authentication, lets attacker gain higher access | 10.0 |
| CVE-2026-56162 | Azure SQL Database | Broken authentication, lets attacker gain higher access | 10.0 |
| CVE-2026-65667 | Microsoft Teams | Missing authorisation check, lets attacker gain higher access | 10.0 |
| CVE-2026-50515 | Azure Service Bus | Remote code execution, lets attacker run their own commands | 9.9 |
| CVE-2026-65400 | macOS Screen Sharing | Bypasses login, lets attacker view your screen remotely | 7.5 |
Should ordinary computer users be worried?
For most home users, the Apple fix is the one to act on today. If your Mac has Screen Sharing turned on, so someone can view or control it remotely, an attacker on the same network could connect without knowing your password. Real risk in shared offices, co-working spaces, or any building with shared Wi-Fi.
Update your Mac now: System Settings, General, Software Update.
For businesses on Microsoft software, the Teams flaw and the Active Directory bug deserve immediate attention. Active Directory is the gatekeeper used by most organisations to control which employees can reach which files. A flaw that lets attackers climb to a higher access level than they were granted is exactly what ransomware groups use to spread from one machine across a whole network. Worth remembering: we reported in July that a gang was already abusing Teams calls to deploy ransomware within 17 hours. A Teams authentication hole makes that playbook cheaper to run.
What should IT teams do right now?
Apply Microsoft's patches now, starting with anything touching Azure SQL and Active Directory. The failure mode is familiar: a patch sits in a change-window queue for two weeks while an exploit circulates by day four.
For Azure-hosted services, Microsoft applies cloud-side fixes automatically in many cases, but check your Azure portal. Don't assume.
If this bites anyone, the post-mortem will note the obvious: authentication gaps rated maximum severity still needed a human to press the button. Press it.
