---METADATA---
VENDOR: Microsoft
PRODUCT: Azure AI Foundry
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
Improper authorization in Azure AI Foundry allows unauthenticated network attackers to escalate privileges, potentially compromising AI models and sensitive data.

Executive Summary:
A critical authorization flaw in Azure AI Foundry enables unauthenticated attackers to elevate privileges over a network, threatening the integrity of AI infrastructure.

Vulnerability Details

CVE-ID: CVE-2026-32213

Affected Software: Microsoft Azure AI Foundry

Affected Versions: See vendor advisory

Vulnerability: This vulnerability is characterized by improper authorization logic within the Azure AI Foundry platform. An unauthenticated attacker can exploit this weakness over a network to gain elevated privileges, bypassing intended security controls that protect AI development and deployment resources.

Business Impact

The compromise of AI Foundry could lead to the theft or modification of proprietary AI models, unauthorized access to training datasets, and the potential for "model poisoning." With a CVSS score of 10.0, this vulnerability represents a total loss of confidentiality, integrity, and availability for the affected AI services, posing a severe threat to corporate intellectual property.

Remediation Plan

Immediate Action: Apply the latest security updates provided by Microsoft for Azure AI Foundry and verify that all access control configurations are aligned with current vendor recommendations.

Proactive Monitoring: Audit privilege assignments within the AI Foundry environment and monitor for any unauthorized modifications to AI models or deployment configurations.

Compensating Controls: Utilize Azure Private Link to isolate AI Foundry traffic and implement multi-factor authentication (MFA) across all associated service accounts to provide layered defense.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 3, 2026, there is no public information indicating active exploitation. The critical CVSS score suggests that the vulnerability is easily exploitable and provides high-impact access to the attacker.

Analyst Recommendation

Given the critical nature of Azure AI Foundry in modern enterprise operations, this CVSS 10.0 vulnerability must be addressed with the highest priority. Administrators should immediately apply vendor patches and conduct a thorough review of all user permissions within the AI environment to ensure no unauthorized elevation has occurred.

---METADATA---
VENDOR: Microsoft
PRODUCT: Azure MCP Server
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A missing authentication vulnerability in Azure MCP Server allows unauthenticated attackers to disclose sensitive information over a network.

Executive Summary:
Critical functions in Azure MCP Server are accessible without authentication, allowing remote attackers to perform unauthorized information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-32211

Affected Software: Azure MCP Server

Affected Versions: See vendor advisory

Vulnerability: This vulnerability involves a failure to enforce authentication for a critical function within the Azure MCP Server. An unauthenticated attacker can exploit this over a network to access sensitive data that should be protected by security credentials.

Business Impact

The unauthorized disclosure of information from the MCP Server could provide attackers with the technical details needed to launch further, more complex attacks against the environment. With a CVSS score of 9.1, this flaw poses a high risk to data confidentiality and can lead to the exposure of proprietary system configurations or user data.

Remediation Plan

Immediate Action: Update the Azure MCP Server to the latest version to ensure that authentication is properly enforced across all critical functions.

Proactive Monitoring: Review server access logs for requests to management or data functions that lack associated authentication tokens or session IDs.

Compensating Controls: Place the MCP Server behind a VPN or a Zero Trust Network Access (ZTNA) gateway to ensure that only verified users can reach the network interface.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of April 3, 2026, no public exploitation has been reported. Missing authentication on critical functions is a common target for automated scanners, increasing the likelihood of discovery.

Analyst Recommendation

Immediate patching is required to prevent unauthorized data access. Security teams should verify that the update correctly applies authentication requirements to all exposed endpoints and consider additional network-level access controls to protect the server.

---METADATA---
VENDOR: Microsoft
PRODUCT: Dynamics
AFFECTED_VERSIONS: See vendor advisory
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network.

Executive Summary:
A critical SSRF vulnerability in Microsoft Dynamics 365 enables unauthenticated attackers to conduct spoofing attacks, posing a high risk to business application integrity.

Vulnerability Details

CVE-ID: CVE-2026-32210

Affected Software: Microsoft Dynamics

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This SSRF vulnerability allows an unauthorized attacker to manipulate the server into making unintended requests. This capability can be leveraged to spoof trusted network entities and potentially bypass security controls.

Business Impact

A CVSS score of 9.3 indicates a critical risk to the confidentiality and integrity of business-critical data stored within Dynamics 365. Exploitation could allow attackers to interact with internal services that are not exposed to the public internet.

Remediation Plan

Immediate Action: Apply all available patches for Microsoft Dynamics 365 as directed by the vendor.

Proactive Monitoring: Monitor for unusual outbound traffic originating from the Dynamics environment and review logs for suspicious request patterns.

Compensating Controls: Restrict server network access to known-good endpoints and utilize WAF rules to block malicious request structures.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the central role Dynamics 365 plays in business operations, this vulnerability must be addressed immediately. Organizations should verify their patch status and ensure that network-level restrictions are in place to limit the exposure of the application.

---METADATA---
VENDOR: Microsoft
PRODUCT: Edge
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
Microsoft Edge contains a cross-site scripting (XSS) vulnerability that allows an authenticated attacker to perform spoofing attacks over a network.

Executive Summary:
A high-severity cross-site scripting vulnerability in Microsoft Edge allows authenticated attackers to conduct spoofing attacks, posing a significant risk to user session integrity.

Vulnerability Details

CVE-ID: CVE-2026-32208

Affected Software: Microsoft Edge

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves improper neutralization of input during web page generation, facilitating cross-site scripting (XSS). An attacker must be authenticated within the environment to successfully execute these spoofing actions.

Business Impact

The exploitation of this XSS vulnerability could allow an attacker to inject malicious scripts into trusted web contexts, leading to credential theft, unauthorized actions on behalf of the user, or deceptive content presentation. Given the CVSS score of 8.8, this flaw represents a high risk to business operations, particularly regarding the integrity of internal web applications and user data privacy.

Remediation Plan

Immediate Action: Prioritize the deployment of the latest Microsoft Edge security updates as soon as they are made available by the vendor.

Proactive Monitoring: Review web server and application logs for unusual patterns, such as unexpected script execution or anomalous URL parameters.

Compensating Controls: Ensure that a robust Web Application Firewall (WAF) is configured to detect and block common XSS injection patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 20, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should treat this vulnerability as a high priority due to the potential for session hijacking and spoofing. Ensure that all systems running Microsoft Edge are updated to the latest version immediately upon release to mitigate the risk of unauthorized exploitation.

---METADATA---
VENDOR: WordPress
PRODUCT: Autoptimize, Clearfy Cache, Speed Optimizer
AFFECTED_VERSIONS: Autoptimize < 3.1.15, Clearfy Cache < 2.4.2, Speed Optimizer < 7.7.9
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Multiple WordPress optimization plugins are vulnerable to Cross-Site Scripting (XSS), potentially allowing attackers to execute malicious scripts in a user's browser.

Executive Summary:
A Cross-Site Scripting (XSS) vulnerability affecting multiple WordPress optimization plugins could allow unauthenticated attackers to hijack user sessions or inject malicious content.

Vulnerability Details

CVE-ID: CVE-2026-3220

Affected Software: WordPress plugins: Autoptimize, Clearfy Cache, Speed Optimizer

Affected Versions: Autoptimize < 3.1.15; Clearfy Cache < 2.4.2; Speed Optimizer < 7.7.9

Vulnerability: This is a Cross-Site Scripting (XSS) vulnerability (CWE-79) that can be triggered by an unauthenticated attacker, allowing for the execution of arbitrary JavaScript in the context of the victim's session.

Business Impact

Successful exploitation could result in full account takeover of administrative users, unauthorized configuration changes, or the injection of malicious content into the website. Given the CVSS score of 8.8, the potential for high-impact compromise makes this a critical priority for all WordPress administrators.

Remediation Plan

Immediate Action: Update the affected plugins (Autoptimize to 3.1.15, Clearfy Cache to 2.4.2, and Speed Optimizer to 7.7.9) immediately.

Proactive Monitoring: Monitor site activity logs for suspicious administrative actions or unauthorized changes to site settings.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter malicious input and block known XSS attack patterns targeting these specific plugins.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 19, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication.

Analyst Recommendation

WordPress administrators must treat this as a high-priority update. Given the risk of session hijacking and unauthorized administrative control, ensure all instances of the identified plugins are updated to the patched versions immediately to secure the platform.

---METADATA---
VENDOR: Microsoft
PRODUCT: Bing Images
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A command injection vulnerability in Microsoft Bing Images allows an unauthorized attacker to execute arbitrary code via network-based requests.

Executive Summary:
A critical command injection flaw in Microsoft Bing Images enables unauthenticated attackers to achieve remote code execution on affected systems.

Vulnerability Details

CVE-ID: CVE-2026-32194

Affected Software: Microsoft Bing Images

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves improper neutralization of special elements within a command string. It allows an unauthenticated attacker to inject and execute arbitrary commands over the network, bypassing intended security boundaries within the Bing Images infrastructure.

Business Impact

This vulnerability poses a severe threat to system integrity and data confidentiality. An attacker could potentially take complete control of the affected server, leading to service disruption and unauthorized access to backend resources. The CVSS score of 9.8 indicates that the vulnerability is easily exploitable and has a devastating impact on the affected system's security posture.

Remediation Plan

Immediate Action: Update Microsoft Bing Images to the latest version and consult the vendor security advisory for specific patch implementation details.

Proactive Monitoring: Implement enhanced logging for the Bing Images service to identify and alert on suspicious command-line arguments or unexpected execution flows.

Compensating Controls: Utilize endpoint detection and response (EDR) tools to monitor for unauthorized shell activity and restrict network access to the affected service where possible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 19, 2026, there is no public information indicating active exploitation of this vulnerability. Due to the high impact of command injection, this flaw is likely to be targeted by sophisticated threat actors.

Analyst Recommendation

Organizations must treat this RCE vulnerability as a critical priority. Immediate application of the vendor-provided patch is the only effective way to mitigate the risk of full system takeover. Ensure all instances of the Bing Images service are accounted for and updated.

---METADATA---
VENDOR: Microsoft
PRODUCT: Azure Kubernetes Service
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A path traversal vulnerability in Microsoft Azure Kubernetes Service allows an authenticated attacker to execute arbitrary code locally.

Executive Summary:
An authorized attacker can exploit a path traversal vulnerability in Microsoft Azure Kubernetes Service to achieve local code execution.

Vulnerability Details

CVE-ID: CVE-2026-32193

Affected Software: Microsoft Azure Kubernetes Service

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The vulnerability involves improper limitation of pathnames to restricted directories, allowing an authenticated user to escape intended boundaries and execute local code.

Business Impact

With a CVSS score of 8.8, this flaw represents a significant risk to the integrity of the Kubernetes environment. An attacker with existing access could escalate privileges or compromise the host, potentially leading to unauthorized data access or disruption of containerized services.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Microsoft to the Azure Kubernetes Service environment immediately.

Proactive Monitoring: Monitor Kubernetes API logs and container execution logs for anomalous path access or unexpected process execution.

Compensating Controls: Implement strict Role-Based Access Control (RBAC) to limit the number of users who can interact with the service, reducing the attack surface.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 10, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Security teams should prioritize the deployment of the vendor's security update to remediate this path traversal flaw. Reducing the blast radius via robust RBAC policies is highly recommended as part of the defense-in-depth strategy.

---METADATA---
VENDOR: Microsoft
PRODUCT: Bing Images
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
An OS command injection vulnerability in Microsoft Bing Images allows an unauthenticated attacker to execute arbitrary code over a network.

Executive Summary:
Microsoft Bing Images is susceptible to a critical OS command injection vulnerability that permits unauthenticated remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-32191

Affected Software: Microsoft Bing Images

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application fails to properly neutralize special elements used in OS commands, leading to a classic OS command injection flaw. This allows an unauthenticated attacker to send crafted network requests that trigger arbitrary code execution on the underlying host.

Business Impact

A successful exploit allows an attacker to gain full control over the server hosting the Bing Images component. This could result in the theft of proprietary data, lateral movement into the internal Microsoft network, and significant reputational damage. The CVSS score of 9.8 underscores the critical nature of this vulnerability, as it requires no authentication and can be exploited remotely.

Remediation Plan

Immediate Action: Apply the latest security updates for Microsoft Bing Images immediately to patch the command injection vector.

Proactive Monitoring: Monitor system logs for unusual process executions (e.g., cmd.exe or /bin/sh) spawning from the web service and review network traffic for suspicious payloads.

Compensating Controls: Deploy an updated Web Application Firewall (WAF) rule set designed to detect and block OS command injection patterns in HTTP parameters.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, OS command injection is a highly sought-after exploit target for threat actors, making immediate patching essential.

Analyst Recommendation

The risk of unauthenticated remote code execution (RCE) necessitates immediate remediation. IT administrators should prioritize this update to prevent host-level compromise. Failure to patch could allow an attacker to establish a persistent foothold within the infrastructure.

---METADATA---
VENDOR: Microsoft (Azure)
PRODUCT: SRE Agent
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
Improper authentication in the Azure SRE Agent allows an unauthorized network-based attacker to disclose sensitive information.

Executive Summary:
An authentication bypass vulnerability in the Azure SRE Agent enables unauthenticated attackers to remotely access and disclose sensitive system information.

Vulnerability Details

CVE-ID: CVE-2026-32173

Affected Software: Microsoft Azure SRE Agent

Affected Versions: See vendor advisory for affected versions

Vulnerability: The Azure SRE Agent suffers from an improper authentication flaw that fails to validate the identity of requesting entities over the network. This allows an unauthenticated attacker to bypass security checks and retrieve information that should be restricted to authorized personnel.

Business Impact

Information disclosure at the agent level can provide attackers with the reconnaissance data needed to launch more complex secondary attacks against the Azure environment. With a CVSS score of 8.6, this vulnerability represents a high risk to organizational confidentiality and could lead to the exposure of internal system configurations.

Remediation Plan

Immediate Action: Apply the Microsoft-provided security updates for the Azure SRE Agent immediately to enforce proper authentication.

Proactive Monitoring: Review network traffic logs for unauthorized connections to the SRE Agent ports and audit access logs for unexpected data retrieval.

Compensating Controls: Restrict network access to the SRE Agent using network security groups (NSGs) or host-based firewalls to allow only trusted IP addresses.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of April 4, 2026, there is no public information indicating active exploitation of this vulnerability. The high CVSS score and the nature of the "unauthorized" access make this a high-priority target for remediation.

Analyst Recommendation

Immediate patching of the Azure SRE Agent is critical to prevent information leakage that could facilitate a broader compromise. Security teams should verify that the agent is updated across all cloud instances and restrict its network exposure to the minimum required for operations.

---METADATA---
VENDOR: Microsoft
PRODUCT: Azure Cloud Shell
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A server-side request forgery (SSRF) vulnerability in Azure Cloud Shell allows an unauthenticated attacker to elevate privileges over a network.

Executive Summary:
A critical SSRF vulnerability in Azure Cloud Shell allows unauthenticated attackers to escalate privileges, potentially compromising the cloud environment.

Vulnerability Details

CVE-ID: CVE-2026-32169

Affected Software: Microsoft Azure Cloud Shell

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Server-Side Request Forgery (SSRF) that allows an unauthenticated attacker to manipulate server-side requests. By exploiting this flaw, an attacker can gain elevated privileges within the Azure Cloud Shell environment without requiring initial valid credentials.

Business Impact

The ability for an unauthorized actor to elevate privileges in a cloud management environment like Azure Cloud Shell poses a severe risk to organizational cloud security. A successful exploit could lead to unauthorized access to sensitive cloud resources, data exfiltration, and total compromise of the administrative shell. The CVSS score of 10.0 reflects the maximum possible severity due to the ease of network-based exploitation and the critical nature of the affected service.

Remediation Plan

Immediate Action: Update Azure Cloud Shell to the latest version immediately as recommended by Microsoft to mitigate this critical privilege escalation risk.

Proactive Monitoring: Security teams should review Azure activity logs and Cloud Shell access patterns for any anomalous outbound network requests or unauthorized privilege transitions.

Compensating Controls: Implement strict Network Security Group (NSG) rules and identity-based access controls to limit the blast radius of any potential shell compromise.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 19, 2026, there is no public information indicating active exploitation of this vulnerability. However, because the flaw allows unauthenticated privilege escalation in a core cloud management tool, the potential for exploitation is extremely high.

Analyst Recommendation

This vulnerability represents the highest level of risk to cloud infrastructure integrity. Organizations utilizing Azure Cloud Shell must ensure the service is updated to the latest patched version immediately. Given the CVSS score of 10.0, this should be prioritized as an emergency change to prevent unauthorized administrative access to the cloud environment.

---METADATA---
VENDOR: AdGuard
PRODUCT: AdGuard Home
AFFECTED_VERSIONS: Prior to 0.107.73
---END_METADATA---

Description Summary:
AdGuard Home is vulnerable to an unauthenticated authentication bypass via HTTP/2 cleartext (h2c) upgrades, allowing attackers to process requests as fully authenticated.

Executive Summary:
A critical authentication bypass in AdGuard Home allows unauthenticated attackers to gain full administrative access by exploiting a flaw in HTTP/2 protocol handling.

Vulnerability Details

CVE-ID: CVE-2026-32136

Affected Software: AdGuard Home

Affected Versions: Prior to 0.107.73

Vulnerability: The vulnerability exists in the way AdGuard Home handles HTTP/1.1 requests that upgrade to HTTP/2 cleartext (h2c). The resulting connection bypasses the authentication middleware, allowing all subsequent HTTP/2 requests on that connection to be treated as fully authenticated without any credentials.

Business Impact

Attackers can gain complete control over network-wide ad-blocking and DNS settings, enabling them to redirect traffic to malicious sites or disable security protections. The CVSS score of 9.8 reflects the high severity of losing administrative control over a central network security component.

Remediation Plan

Immediate Action: Update AdGuard Home to version 0.107.73 or later to resolve the authentication middleware flaw.

Proactive Monitoring: Check logs for HTTP/1.1 to h2c upgrade requests and review DNS configuration history for unauthorized changes.

Compensating Controls: Disable HTTP/2 cleartext support if possible, or use a reverse proxy that properly handles authentication before passing traffic to the AdGuard Home service.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation. This protocol-level bypass is sophisticated but highly effective, making it a critical risk for internet-facing instances.

Analyst Recommendation

Immediate patching is required to prevent unauthorized administrative access. Organizations and home users should ensure their AdGuard Home instances are updated to version 0.107.73 and should avoid exposing the management interface to the public internet.

---METADATA---
VENDOR: Plunk
PRODUCT: Plunk
AFFECTED_VERSIONS: Prior to 0.7.0
---END_METADATA---

Description Summary:
Plunk contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in its SNS webhook handler, allowing attackers to make arbitrary outbound GET requests.

Executive Summary:
An unauthenticated SSRF vulnerability in Plunk allows attackers to probe internal network resources and potentially exfiltrate sensitive cloud metadata.

Vulnerability Details

CVE-ID: CVE-2026-32096

Affected Software: Plunk (Email Platform)

Affected Versions: Prior to 0.7.0

Vulnerability: A flaw in the Amazon Simple Notification Service (SNS) webhook handler allows an unauthenticated attacker to send crafted requests. This forces the server to initiate arbitrary outbound HTTP GET requests to any host, including internal services or cloud metadata endpoints (e.g., IMDS).

Business Impact

A successful SSRF attack can lead to the compromise of internal services not exposed to the internet and the theft of sensitive environment variables or cloud IAM credentials. The CVSS score of 9.3 highlights the significant risk to the confidentiality and security of the underlying AWS infrastructure.

Remediation Plan

Immediate Action: Update the Plunk platform to version 0.7.0 or higher immediately.

Proactive Monitoring: Monitor outbound network logs for unusual GET requests originating from the Plunk server, particularly those targeting internal IP ranges or the 169.254.169.254 metadata address.

Compensating Controls: Implement egress filtering to restrict the Plunk server's ability to communicate with internal network segments or sensitive cloud metadata services.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation. SSRF vulnerabilities are frequently used in cloud environments to escalate privileges by targeting instance metadata services.

Analyst Recommendation

The ability for an unauthenticated attacker to trigger outbound requests is a high-risk scenario. Administrators must apply the version 0.7.0 patch immediately and verify that the server's network permissions follow the principle of least privilege.