Consulta vulnerabilidades CVE, conoce su impacto y verifica las medidas de corrección en fuentes oficiales.
CVE
Riesgo
KB asociado
Descripcion del KB
Fecha de liberacion
CVE-2026-26164
Critical
N/D
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-31705
Critical
N/D
N/D
12/05/2026
CVE-2026-31718
Critical
N/D
N/D
12/05/2026
CVE-2026-32161
Critical
KB5087538
5087538
12/05/2026
CVE-2026-32161
Critical
N/D
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver allows an unauthorized attacker to execute code over an adjacent network. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Exploitation requires specific conditions, including particular network configurations and timing conditions, and has only been observed in limited scenarios. This means an attacker cannot reliably exploit the issue in all environments and may need favorable setup or circumstances for it to work. According to the CVSS score, the attack vector is adjacent (AV:A). What does this mean for this vulnerability?
This attack is limited to systems connected to the same network segment as the attacker. The attack cannot be performed across multiple networks (for example, a WAN) and would be limited to systems on the same network switch or virtual network.
12/05/2026
CVE-2026-32161
Critical
KB5087545
5087545
12/05/2026
CVE-2026-32161
Critical
KB5087424
5087424
12/05/2026
CVE-2026-32161
Critical
KB5087544
5087544
12/05/2026
CVE-2026-32161
Critical
KB5094127
5094127
12/05/2026
CVE-2026-32161
Critical
KB5087539
5087539
12/05/2026
CVE-2026-32161
Critical
KB5087423
5087423
12/05/2026
CVE-2026-32161
Critical
KB5089549
5089549
12/05/2026
CVE-2026-32161
Critical
KB5089466
5089466
12/05/2026
CVE-2026-32161
Critical
KB5087420
5087420
12/05/2026
CVE-2026-32161
Critical
KB5093998
5093998
12/05/2026
CVE-2026-32161
Critical
KB5087541
5087541
12/05/2026
CVE-2026-32161
Critical
KB5089548
5089548
12/05/2026
CVE-2026-32161
Critical
KB5087537
5087537
12/05/2026
CVE-2026-32161
Critical
KB5087470
5087470
12/05/2026
CVE-2026-32161
Critical
KB5087471
5087471
12/05/2026
CVE-2026-32207
Critical
N/D
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-33109
Critical
N/D
Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-33111
Critical
N/D
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-33278
Critical
N/D
N/D
12/05/2026
CVE-2026-33821
Critical
N/D
Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-33823
Critical
N/D
Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-33843
Critical
N/D
Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-33844
Critical
N/D
Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-34327
Critical
N/D
Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-35421
Critical
KB5087538
5087538
12/05/2026
CVE-2026-35421
Critical
N/D
Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
For this vulnerability to be exploited, a user would need to open or otherwise process a specially crafted Enhanced Metafile (EMF) file using Microsoft Paint. This action is necessary to trigger the affected graphics functionality in the Windows component.
12/05/2026
CVE-2026-35421
Critical
KB5087545
5087545
12/05/2026
CVE-2026-35421
Critical
KB5087424
5087424
12/05/2026
CVE-2026-35421
Critical
KB5087544
5087544
12/05/2026
CVE-2026-35421
Critical
KB5094127
5094127
12/05/2026
CVE-2026-35421
Critical
KB5087539
5087539
12/05/2026
CVE-2026-35421
Critical
KB5087423
5087423
12/05/2026
CVE-2026-35421
Critical
KB5089549
5089549
12/05/2026
CVE-2026-35421
Critical
KB5089466
5089466
12/05/2026
CVE-2026-35421
Critical
KB5087420
5087420
12/05/2026
CVE-2026-35421
Critical
KB5093998
5093998
12/05/2026
CVE-2026-35421
Critical
KB5087541
5087541
12/05/2026
CVE-2026-35421
Critical
KB5089548
5089548
12/05/2026
CVE-2026-35421
Critical
KB5087537
5087537
12/05/2026
CVE-2026-35421
Critical
KB5087470
5087470
12/05/2026
CVE-2026-35421
Critical
KB5087471
5087471
12/05/2026
CVE-2026-35428
Critical
N/D
Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-35430
Critical
N/D
Authorization bypass through user-controlled key in Azure Privileged Identity Management (PIM) allows an authorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-35435
Critical
N/D
Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-39821
Critical
N/D
N/D
12/05/2026
404
Visitas totales
162
Visitantes únicos