Critical Azure Vulnerabilities: Remote Attack, Privilege Escalation

CERT-Bund has issued a security advisory (WID-SEC-2026-0794) detailing critical vulnerabilities affecting Microsoft Azure DevOps, Data Factory, and Cloud Shell. The advisory highlights a CVSS base score of 10.0, indicating a critical severity. These vulnerabilities enable remote, anonymous attackers to escalate privileges, manipulate data, and expose confidential information.

While this is a security advisory and not a regulatory rule, affected organizations using these Azure services should treat this as a high-priority alert. Mitigation measures are available, and prompt action is recommended to address the identified risks and prevent potential data breaches or system compromises. The advisory does not specify a compliance deadline but emphasizes the critical nature of the vulnerabilities.