Microsoft Pushes 22 Security Fixes, Six Rated Maximum Severity
A batch of patches covers Microsoft's cloud and identity products, with six flaws scoring a perfect 10 out of 10 on the severity scale. Most fixes apply automatically, but one Defender vulnerability is still waiting for a patch.
Key points
- Microsoft released 22 security updates on Thursday, fixing flaws across Azure, Entra ID, Exchange, Fabric, and Partner Center.
- Six vulnerabilities scored 10 out of 10 on the CVSS severity scale, meaning researchers consider them as serious as a flaw can get.
- Most fixes have already been applied by Microsoft on its own servers, so the majority of customers need to do nothing.
- A separate flaw in Microsoft Defender, tracked as CVE-2026-69414, is publicly known but still unpatched as of publication.
- The unpatched Defender flaw was publicly released by a security researcher in August 2026, meaning criminals already know how to use it.
Microsoft shipped 22 security fixes on Thursday, targeting serious weaknesses across the tools that millions of businesses use to store data, manage who logs in, and run cloud workloads.
How bad is this?
Six of the flaws scored a 10 out of 10, the maximum possible rating on the CVSS scale, which researchers use to measure how dangerous a vulnerability is. That rating means the flaw is easy to exploit, needs no special access, and can cause serious harm.
Three of the perfect-10 bugs are elevation-of-privilege flaws, meaning an attacker who already has limited access to a system could use them to quietly promote themselves to full administrator. They affect Azure SQL Database (CVE-2026-69502), Azure Arc (CVE-2026-69555 and CVE-2026-65816), and Exchange Online (CVE-2026-65801), the cloud service businesses use for company email.
The remaining two maximum-severity bugs are remote-code-execution flaws, which is the technical way of saying an attacker could run their own malicious software on someone else's machine without ever touching it. Those affect Azure Managed Instance for Apache Cassandra (CVE-2026-65770) and Entra ID (CVE-2026-69836), Microsoft's system for controlling who is allowed to sign in to a company's apps and services.
Seven more critical elevation-of-privilege bugs were patched across Azure SQL Database, Microsoft Fabric, Entra ID, Azure Logic Apps, and Azure Data Factory.
| CVE ID | Product | Type | Severity |
|---|---|---|---|
| CVE-2026-69502 | Azure SQL Database | Elevation of privilege | 10/10 |
| CVE-2026-69555 | Azure Arc | Elevation of privilege | 10/10 |
| CVE-2026-65816 | Azure Arc | Elevation of privilege | 10/10 |
| CVE-2026-65801 | Exchange Online | Elevation of privilege | 10/10 |
| CVE-2026-65770 | Azure Managed Instance (Cassandra) | Remote code execution | 10/10 |
| CVE-2026-69836 | Entra ID | Remote code execution | 10/10 |
Do customers need to do anything?
For most of these fixes, no. Microsoft has already applied the patches on its own servers, so businesses and individuals using these cloud services are protected without lifting a finger.
The one exception worth watching is the Defender situation.
What is the unpatched Defender flaw?
A fix is still coming. A security researcher known publicly as Nightmare Eclipse (also called Chaotic Eclipse) publicly released details of an attack technique called ShieldBreak during August 2026's regular patch cycle. Microsoft confirmed the underlying flaw is real, scored it 7.8 out of 10, and assigned it CVE-2026-69414. Microsoft Defender is the built-in antivirus and security tool that ships with Windows.
Microsoft said it is "working to provide a high-quality security update" for ShieldBreak. Because the technique is already public, security teams running Windows environments should watch for unusual activity and keep an eye on Microsoft's advisory page for the patch release.
MFA, meaning multi-factor authentication (where logging in requires both a password and a second check, like a code sent to your phone), would not prevent exploitation of most of these server-side flaws directly. Keeping cloud service configurations tight and monitoring for unexpected administrator-level activity is the practical step here.
