Severity Daily

IT and AI security incidents, checked against the primary source

Tag: Copilot Studio

  • Microsoft published eight cloud CVEs overnight, two of them 10.0, and not one carries an affected version

    Microsoft published eight cloud CVEs overnight, two of them 10.0, and not one carries an affected version

    Microsoft published eight cloud-service CVE records on September 3, 2026, timestamped into the National Vulnerability Database at 11:17 p.m. UTC — 6:17 p.m. Eastern, after the US business day and while most of Europe was asleep. Two of the eight are scored 10.0. Every one of them tells the reader that the flaw is already fixed and that no customer action is required. None of them says what versions were affected, when the flaw was introduced, how long it was live, or whether any tenant was touched.

    What happened

    All eight records carry the source identifier [email protected] and were published within a single second of each other. In descending order of score:

    • CVE-2026-70352, Azure AI Language, CVSS 10.0. Microsoft’s own description: “Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.” CWE-306. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — network reachable, no privileges, no user interaction, changed scope, and high impact across all three of confidentiality, integrity, and availability. That combination is what produces a perfect score.
    • CVE-2026-83711, Microsoft Azure Active Directory B2C, CVSS 10.0. “Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.” CWE-639.
    • CVE-2026-80098, Copilot Studio, CVSS 9.3. “Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.”
    • CVE-2026-62916, Microsoft Entra ID, CVSS 9.1. “Authentication bypass using an alternate path or channel.”
    • CVE-2026-70178, Microsoft Fabric, CVSS 8.5, missing authorization.
    • CVE-2026-69857, Azure Cosmos DB, CVSS 8.5, authorization bypass through user-controlled key, leading to spoofing.
    • CVE-2026-65818, Power Automate, CVSS 8.5, server-side request forgery.
    • CVE-2026-62906, Microsoft Discovery Studio, CVSS 7.4, information disclosure through improper neutralization of special elements in data query logic.

    The Microsoft Security Response Center entries for the critical four all carry the same closing language. For Azure Active Directory B2C and Copilot Studio the wording is identical: “This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.” Customer action required is set to No on all four. The MSRC temporal vector on each ends E:U/RL:O/RC:C — exploit code unproven, official fix available, report confidence confirmed.

    Two of the four also sit in Microsoft’s AI product line. Azure AI Language is the hosted natural-language service; Copilot Studio is the agent-building platform. A third, Microsoft Discovery Studio, is part of the Microsoft Discovery research platform. Identity accounts for two more: Entra ID and Azure AD B2C, the customer-facing identity tenant used by organizations to sign in their own end users rather than their staff.

    The record gap is the part worth pausing on. Pulled in full from NVD, CVE-2026-83711 and CVE-2026-70352 have no configurations array at all — no CPE match criteria, no product string, no version range. Both sit at vulnStatus of “Received.” Each carries exactly one reference: its own MSRC page. And that MSRC page, fetched without a browser, returns the string “You need to enable JavaScript to run this app.” The advisory text quoted above came from Microsoft’s api.msrc.microsoft.com JSON endpoint, not from the page NVD points at.

    Why it matters

    Microsoft began issuing CVEs for cloud-service vulnerabilities in 2024 under a transparency commitment, and the commitment is real — before it, a 10.0 in a hosted identity service would have been fixed silently and never numbered. Eight records in one batch is the program working. The question this batch raises is what a customer is supposed to do with the result.

    A CVE is not only a disclosure. It is an index entry. Almost every downstream consumer of vulnerability data — scanners, software composition tools, ticketing integrations, the vulnerability management program that owns your monthly report — keys off the CPE match criteria to decide whether a record concerns you. A record with no configurations array matches nothing. It will not appear in a scan result, will not open a ticket, and will not show up in the report that tells a board how many criticals the organization is carrying. The two 10.0 scores are, for automated purposes, invisible.

    That is defensible when there is genuinely no action. It is less defensible as a historical record. “Already fully mitigated” is a statement about the present. It answers the question a customer will ask today and not the one they will ask after an incident: was my tenant exposed, and for how long? None of the eight records carries a discovery date, an introduction date, a remediation date, or a statement that Microsoft reviewed logs and found no abuse. The temporal vector says E:U — exploit code unproven — which is a claim about public exploit availability, not a finding that no one used the flaw.

    Azure AD B2C is the sharpest version of this. B2C is the tenant type organizations point their customers at: retail logins, patient portals, member accounts. An authorization bypass through a user-controlled key at 10.0, in that product, is a question a regulator or a breach-notification lawyer will eventually ask about with a date attached. The record as published cannot answer it. Neither can the customer, because B2C sign-in logs live in the customer’s tenant but the flaw and its fix lived in Microsoft’s service, and no indicator has been published to search those logs for.

    The JavaScript-only advisory page compounds it. This publication has flagged the pattern before, on an HPE bulletin whose remediation table would not render to anything that was not a browser. When the sole reference on a CVSS 10.0 record resolves to an application shell, the machine-readable record and the human-readable record are two different documents, and only one of them is what NVD links. Microsoft does publish the same content through a documented JSON API, which is more than some vendors offer. It is not what the CVE record points at.

    What to do

    There is no patch, and Microsoft is right that there is no action in the ordinary sense. The useful work is record-keeping and scope confirmation.

    • If you run Azure AD B2C, note CVE-2026-83711 against the service in your own risk register with the September 3, 2026 publication date, since it will not arrive through your scanner. The same applies to CVE-2026-62916 for Entra ID.
    • If you use Copilot Studio or Azure AI Language, treat CVE-2026-80098 and CVE-2026-70352 the same way. An improper signature verification flaw in an agent-building platform is worth a line in whatever inventory you keep of AI services that hold organizational data.
    • Ask Microsoft support, through your account team, for the exposure window and for any tenant-level indicators for the two 10.0 records. If the answer is that none exist, that answer is itself worth recording.
    • Do not expect these to appear in vulnerability scan output. If your program measures itself on scanner counts, these eight will not move the number, and that is a property of the data, not of the risk.
    • Read the advisories through api.msrc.microsoft.com/sug/v2.0/en-US/vulnerability/<CVE> if you are collecting them programmatically. The msrc.microsoft.com/update-guide URL in the CVE record will not return text.

    Sourcing note

    Checked: NVD records for all eight CVEs, retrieved from the NIST CVE API on September 4, 2026, including full records for CVE-2026-83711 and CVE-2026-70352; Microsoft Security Response Center advisory data for CVE-2026-70352, CVE-2026-83711, CVE-2026-80098, and CVE-2026-62916, retrieved from Microsoft’s api.msrc.microsoft.com endpoint. All quoted descriptions and mitigation language are Microsoft’s own, reproduced exactly.

    Could not reach: the human-readable MSRC update-guide pages, which returned only “You need to enable JavaScript to run this app.” The finding that the pages do not render without a browser is first-hand from this fetch; a reader with a browser will see the advisory normally.

    Unresolved: whether any of the eight records will later receive CPE match criteria — they were at vulnStatus “Received” at the time of writing, and NVD may enrich them. Whether Microsoft will publish exposure windows or tenant indicators for the two 10.0 records. Whether the temporal E:U reflects a Microsoft investigation into abuse or only the absence of public exploit code; the advisories do not say. No acknowledgements are listed on any of the four critical records, so the finder is not identified.