Cert-In-Advisories

[CIVN-2026-0231] Multiple Vulnerabilities in Microsoft Products

By TeamwinPublished On: May 14, 2026

—–BEGIN PGP SIGNED MESSAGE—–

Hash: SHA256

Multiple Vulnerabilities in Microsoft Products

Indian – Computer Emergency Response Team (https://www.cert-in.org.in)

Severity Rating: CRITICAL

Software Affected

Windows 10: Versions 21H2 and 22H2

Windows 11Versions 23H2, 24H2, and 25H2

Windows Server: 2016, 2019, 2022, 2022 (23H2 Edition), and 2025

Microsoft Office / Microsoft 365 Apps

Microsoft Edge (Chromium-based)

ASP.NET Core

Azure DevOps Server / Services

SharePoint Server

Microsoft Azure cloud components

Overview

Multiple vulnerabilities have been identified in Microsoft cloud and AI-integrated service, Azure, Microsoft 365, Teams, Copilot, and Edge. These vulnerabilities could allow attackers to execute arbitrary code, insufficient input validation, disclose sensitive information, or perform spoofing attacks, potentially leading to compromise system.

Target Audience:

All organizations and individuals using affected Microsoft products.

Risk Assessment:

High risk due to the potentially exploiting information disclosure, spoofing, remote code execution, and injection-based attacks due to improper input validation.

Impact Assessment:

Data exposure, service compromise, privilege escalation, remote code execution, and disruption of cloud and AI services.

Description

These vulnerabilities exists in Microsoft Azure and M365 services primarily caused by insufficient input validation this can result in unauthorized access to sensitive data, compromise of cloud and AI services, privilege escalation, remote code execution, and service disruption across affected environments.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code privilege escalation, access sensitive data and service disruption.

Solution

Apply appropriate updates as mentioned by the vendor:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42826

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35428

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-35435

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-34327

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33844

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33823

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32207

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40379

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33109

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33111

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-41105

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26129

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26164

References