Critical Microsoft Cloud Vulnerabilities CVSS 9.9 Affecting Azure, Microsoft 365 Copilot, Dynamics 365, Power Apps
Summary
CERT-Bund, the German Federal Computer Emergency Response Team, published advisory WID-SEC-2026-1256 disclosing critical vulnerabilities in four Microsoft cloud platforms: Azure IoT Central, Microsoft 365 Copilot, Microsoft Dynamics 365 Online, and Microsoft Power Apps. The vulnerabilities carry a CVSS Base Score of 9.9 (critical) and a CVSS Temporal Score of 8.6 (high). An attacker can exploit these flaws to achieve privilege escalation, execute arbitrary code, and conduct spoofing attacks. Mitigation measures are available and organizations using these products are advised to apply them immediately.
“Ein Angreifer kann mehrere Schwachstellen in Microsoft Azure, Microsoft 365 Copilot, Microsoft Dynamics 365 und Microsoft Power Apps ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen und Spoofing-Angriffe durchzuführen.”
Organizations running Azure IoT Central, Microsoft 365 Copilot, Dynamics 365 Online, or Power Apps should verify their current patch status against these vulnerabilities and confirm that available mitigations have been applied. Given the CVSS temporal score of 8.6 (high), indicating that exploit tooling is likely available, unpatched deployments of these cloud products face imminent risk of remote exploitation.
About this source
CERT-Bund is the German federal cybersecurity agency's incident response team, run by the BSI. Their advisory feed publishes vulnerability disclosures and active exploitation warnings for software in widespread enterprise use: VPN appliances, email servers, file transfer products, ERP systems, browsers, hypervisors. Around 280 advisories a month, each with a CVSS score, affected versions, and remediation guidance. The advisories are written in German but cover the same vulnerabilities that show up in CISA, NCSC-UK, and JPCERT bulletins, often hours earlier. Watch this if you patch enterprise software, run a SOC, or write detection rules. GovPing publishes each advisory with the affected vendor, CVSS score, and original CERT-Bund link.
What changed
CERT-Bund published a critical security advisory disclosing multiple vulnerabilities in four major Microsoft cloud products: Azure IoT Central, Microsoft 365 Copilot, Microsoft Dynamics 365 Online, and Microsoft Power Apps. The vulnerabilities have a CVSS Base Score of 9.9 (critical) and a CVSS Temporal Score of 8.6 (high), indicating severe and readily exploitable security flaws. The advisory confirms that remote attacks are possible and that mitigations are available.
Organizations running affected Microsoft cloud products should prioritize patching and apply available mitigations immediately. Security teams should inventory their Azure, Microsoft 365, Dynamics 365, and Power Apps deployments, verify current patch levels, and confirm that mitigation measures have been deployed. Given the CVSS 9.9 rating and confirmed remote attack vector, unpatched systems face critical risk of compromise through privilege escalation, arbitrary code execution, or spoofing attacks.
Archived snapshot
Apr 24, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
[WID-SEC-2026-1256] Microsoft Cloud-Produkte: Mehrere Schwachstellen CVSS Base Score 9.9 (kritisch) CVSS Temporal Score 8.6 (hoch) Remoteangriff ja Datum 23.04.2026 Stand 24.04.2026 Mitigation ja
Betroffene Systeme
Betriebssystem
- Sonstiges
- UNIX
- Windows
Produktbeschreibung
Azure ist eine Cloud Computing-Plattform von Microsoft.
Microsoft Copilot ist ein KI-Assistent, der in verschiedene Microsoft-Produkte integriert werden kann.
Microsoft Dynamics 365 ist eine All-in-One-Unternehmensmanagementlösung.
Microsoft Power Apps ist eine Plattform zur Entwicklung von Low-Code-Anwendungen für Web und mobile Geräte.
Produkte
23.04.2026
- Microsoft Azure IOT Central
Microsoft 365 Copilot
Microsoft Dynamics 365 online
Microsoft Power Apps
Angriff
Angriff
Ein Angreifer kann mehrere Schwachstellen in Microsoft Azure, Microsoft 365 Copilot, Microsoft Dynamics 365 und Microsoft Power Apps ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen und Spoofing-Angriffe durchzuführen. CVE Informationen Versionshistorie Feedback zum Advisory geben
Related changes
Get daily alerts for CERT-Bund Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from CERT-Bund.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-Bund Security Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.