Microsoft's Security Update Guide added seven cloud-service CVEs on 8 October 2026 (US time), all rated Critical by Microsoft and all marked as already fully mitigated by Microsoft with no action for customers; they are published for transparency under its cloud-service CVE policy. They are CVE-2026-96207, improper certificate validation in Microsoft Partner Center allowing privilege escalation by an unauthenticated attacker (CVSS 10.0); CVE-2026-94510, an authorisation bypass through a user-controlled key in Microsoft Bookings (9.9); CVE-2026-88131, deserialisation of untrusted data allowing unauthenticated code execution in Microsoft Dataverse (9.8); CVE-2026-77900, missing authentication allowing unauthenticated code execution in Azure App Service (9.8); CVE-2026-69435, missing authorisation in Azure SRE Agent allowing an authenticated attacker to escalate privileges (9.6); CVE-2026-83943, information disclosure in Azure API Center (8.7); and CVE-2026-83947, spoofing in Azure Event Grid (7.7).

Microsoft says none were publicly disclosed or exploited. Primary: Microsoft Security Response Center.