Microsoft Pushes 22 Security Fixes, Six Rated Maximum Severity
A batch of patches covers Microsoft's cloud and identity products, with six flaws scoring a perfect 10 out of 10 on the severity scale. Most fixes apply automatically, but one Defender vulnerability is still waiting for a patch.
Key points
- Microsoft released 22 security updates on Thursday, fixing flaws across Azure, Entra ID, Exchange, Fabric, and Partner Center.
- Six vulnerabilities scored 10 out of 10 on the CVSS severity scale, meaning researchers consider them as serious as a flaw can get.
- Most fixes have already been applied by Microsoft on its own servers, so the majority of customers need to do nothing.
- A separate flaw in Microsoft Defender, tracked as CVE-2026-69414, is publicly known but still unpatched as of publication.
- The unpatched Defender flaw was publicly released by a security researcher in August 2026, meaning criminals already know how to use it.
Microsoft shipped 22 security fixes on Thursday, targeting serious weaknesses across the tools that millions of businesses use to store data, manage who logs in, and run cloud workloads.
How bad is this?
Six of the flaws scored a 10 out of 10, the maximum possible rating on the CVSS scale, which researchers use to measure how dangerous a vulnerability is. That rating means the flaw is easy to exploit, requires no special access, and can cause serious harm.
Four of the perfect-10 bugs are elevation-of-privilege flaws, meaning an attacker who already has limited access to a system could use them to quietly promote themselves to full administrator. They affect Azure SQL Database (CVE-2026-69502), Azure Arc (CVE-2026-69555 and CVE-2026-65816), and Exchange Online (CVE-2026-65801), the cloud service businesses use for company email.
The remaining two maximum-severity bugs are remote-code-execution flaws: an attacker could run malicious software on someone else's machine without ever touching it. Those affect Azure Managed Instance for Apache Cassandra (CVE-2026-65770) and Entra ID (CVE-2026-69836), Microsoft's system for controlling who is allowed to sign in to a company's apps and services. We covered a perfect-10 Entra ID remote-code-execution bug patched just days earlier in our 21 August story.
Seven more critical elevation-of-privilege bugs were patched across Azure SQL Database, Microsoft Fabric, Entra ID, Azure Logic Apps, and Azure Data Factory.
| CVE ID | Product | Type | Severity |
|---|---|---|---|
| CVE-2026-69502 | Azure SQL Database | Elevation of privilege | 10/10 |
| CVE-2026-69555 | Azure Arc | Elevation of privilege | 10/10 |
| CVE-2026-65816 | Azure Arc | Elevation of privilege | 10/10 |
| CVE-2026-65801 | Exchange Online | Elevation of privilege | 10/10 |
| CVE-2026-65770 | Azure Managed Instance (Cassandra) | Remote code execution | 10/10 |
| CVE-2026-69836 | Entra ID | Remote code execution | 10/10 |
Do customers need to do anything?
For most of these fixes, no. Microsoft has already applied the patches on its own servers, so cloud customers are protected without lifting a finger.
The one exception worth watching is the Defender situation.
What is the unpatched Defender flaw?
A fix is still coming. A researcher known publicly as Nightmare Eclipse (also called Chaotic Eclipse) dropped details of an attack technique called ShieldBreak during August 2026's regular patch cycle. Microsoft confirmed the flaw is real, scored it 7.8 out of 10, and assigned it CVE-2026-69414. Defender is Windows's built-in antivirus.
Microsoft said it is "working to provide a high-quality security update" for ShieldBreak. The technique is already public, so security teams running Windows environments should watch for unusual activity and check Microsoft's advisory page for the patch release. Our 19 August report on Defender shows this isn't Defender's first rough week.
MFA (multi-factor authentication, where logging in requires both a password and a second check such as a code sent to your phone) wouldn't prevent exploitation of most of these server-side flaws. Keeping cloud service configurations tight and monitoring for unexpected administrator-level activity is the practical step.
