Microsoft issues 22 patches for Azure, Entra ID and Exchange

Microsoft released 22 security updates on Thursday that address critical and high-severity vulnerabilities across Azure, Entra ID, Exchange and other products. The company has applied server-side mitigations for most issues, so many customers do not need to act immediately.

The most severe fixes cover elevation-of-privilege flaws in Azure SQL Database (CVE-2026-69502), Azure Arc (CVE-2026-69555 and CVE-2026-65816) and Exchange Online (CVE-2026-65801). Remote-code-execution vulnerabilities in Azure Managed Instance for Apache Cassandra (CVE-2026-65770) and Entra ID (CVE-2026-69836) were also patched. Each of those carries a CVSS score of 10.0.

Microsoft also resolved seven other critical elevation-of-privilege vulnerabilities: CVE-2026-68782, CVE-2026-68789 and CVE-2026-66309 in Azure SQL Database; CVE-2026-63509 in Microsoft Fabric; CVE-2026-69851 in Entra ID; CVE-2026-69400 in Azure Logic Apps; and CVE-2026-62834 in Azure Data Factory. High-severity fixes address issues in Azure Virtual Machines, Microsoft Partner Center, Azure Stack HCI, Azure Data Manager for Energy, Copilot in Azure and Windows Remote Help Defense.

When local updates are required, Microsoft publishes guidance and deployment details in its security advisories and update channels. Administrators should review those advisories to confirm whether server-side mitigations cover their environments and to apply any client-side patches that are needed.

Earlier this week Microsoft patched a high-severity command-injection bug in Copilot that could allow remote information disclosure (CVE-2026-24301). The company is also preparing an update for a zero-day vulnerability in the Microsoft Malware Protection Engine tracked as CVE-2026-69414 and publicly referred to as “ShieldBreak”; that issue was disclosed on the August 2026 Patch Tuesday and carries a CVSS score of 7.8.

Microsoft acknowledged the ShieldBreak issue and provided this statement: “Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as ‘ShieldBreak’. We are working to provide a high-quality security update that addresses this vulnerability.”