Microsoft Azure cloud services: three critical flaws (CVE-2026-97785, CVE-2026-110063) fixed by Microsoft, no customer action
CVE-2026-110063 CVE-2026-83938 CVE-2026-97785
Published 04/11/2026 03:35
Timeline
3 events over 12 d
- 22/10/2026 16:00ConfirmedMicrosoft Security Update Guide+8 h
- 23/10/2026 00:17UnconfirmedCommunity post+12 d
- 04/11/2026 03:35Published on WatchtowerPro CISO
In short
Microsoft has confirmed three critical privilege-escalation flaws in Azure cloud services: Entra application proxy (AAD App Proxy), VM Inspector for Azure Virtual Machines and Azure Kubernetes Configuration Service. Microsoft hosts and has fixed these services itself and says customers need take no action. None is on CISA's known-exploited list.
How bad is it
Critical (CVSS 10.0). An attacker without logging in could gain higher privileges in the affected Microsoft cloud services over the network, but Microsoft has already fixed them and customers need do nothing.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
The worst of 3 CVEs · CVSS 3.1 from NVD, from microsoft.com, read 04/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginNot needed
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
- Change or delete that data
- Take it offline
Type: privilege escalation.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Microsoft Entra application proxy (AAD App Proxy), CVE-2026-97785. Hosted by Microsoft; no versions given.
- VM Inspector for Azure Virtual Machines, CVE-2026-110063. Hosted by Microsoft; no versions given.
- Azure Kubernetes Configuration Service, CVE-2026-83938. Hosted by Microsoft; no customer-checkable version threshold.
Fixed in
- Fixed by Microsoft in the hosted cloud services. No customer update or version is involved.
What to do now
- No patch or update is available or needed: Microsoft has fixed these cloud services itself and says no customer action is required.
- Re-check the Microsoft Security Update Guide pages for CVE-2026-97785, CVE-2026-110063 and CVE-2026-83938 for later revisions, such as a changed exploitability rating.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 5 sources with their dates. And technology matching: which of your systems run AAD App Proxy, at which version, fixed or not - and what each one needs.
Main sources
CVE-2026-97785 AAD App Proxy Elevation of Privilege Vulnerability Vendor · CVE-2026-110063 VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability Vendor · CVE-2026-83938 Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability Vendor