A heap-based buffer overflow in the Windows Client License Service allows an authorized local user with low privileges to elevate privileges to a higher level on the system. Exploitation requires local access and a valid low-privileged account, so the flaw is not directly reachable from the internet. The CNA and NVD rate it as High (CVSS 7.0), with high impact on confidentiality, integrity and availability.
Microsoft · Windows 10 1809
A use-after-free flaw (CWE-416) in the Windows Update Service of Windows 11 and Windows Server 2025 allows an authorized local user to elevate privileges. The attacker needs a valid low-privilege account on the device, and exploitation is rated high-complexity. It is a post-compromise step and not reachable from the internet; the CVSS v3.1 base score is 7.0 (High).
Microsoft · Windows 11
Microsoft Partner Center, Microsoft's cloud-hosted management portal for partners and resellers, contains an improper certificate validation flaw (CWE-295). According to Microsoft, a network-reachable attacker without privileges and without user interaction can elevate privileges, with high impact on confidentiality and integrity (CVSS 10.0). Customers cannot patch the service themselves, because Microsoft applies the fix on its side. The main risk for SMEs is indirect, through their managed service provider or IT partner whose Partner Center access could be affected.
Microsoft · Partner Center
Microsoft Bookings, a cloud service for online scheduling and customer bookings in Microsoft 365, contains an authorization bypass caused by a user-controlled key (CWE-639). An unauthenticated attacker on the network can exploit it to elevate privileges, with a changed scope and high integrity impact according to the CVSS vector. Microsoft applies the fix on its own service, so customers have no patch to install.
Microsoft · Bookings
Microsoft Dataverse, the data platform behind Microsoft business applications, contains a deserialization flaw (CWE-502) that allows deserialization of untrusted data. According to the CVSS vector, an unauthenticated attacker with network access could execute code without user interaction, with a CVSS base score of 9.8. Microsoft states that the vulnerability has already been fully mitigated on its side and that no customer action is required.
Microsoft · Dataverse
A missing authorization check in Microsoft Azure Event Grid, a managed publish-subscribe eventing service, allows an authorized attacker on the network to perform spoofing. The attacker needs valid low-privilege credentials in the target tenant. According to the vendor, the flaw is in the cloud service and has already been fully mitigated by Microsoft. The NVD base score is 6.5, while Microsoft lists 7.7 with a different scope value.
Microsoft · Azure Event Grid
Azure API Center, a cloud service for managing API catalogs and their metadata, contains an information disclosure vulnerability (CWE-200). According to the CVE record, an unauthorized remote attacker can disclose information over the network. The attack requires high complexity, and the exact data types exposed are not disclosed.
Microsoft · Azure API Center
Microsoft Azure App Service is affected by a missing authentication flaw (CWE-306) in a critical function. An unauthenticated attacker on the network could execute code, which would have a total impact on confidentiality, integrity and availability. Microsoft states that it has fully mitigated the issue on its platform, so customers have no action to take.
Microsoft · Azure App Service
Missing authorization in Microsoft Azure SRE Agent allows an authorized attacker with low privileges to elevate privileges over the network. Sources differ on the severity: the CVE data used here lists CVSS 8.1 (scope unchanged), while Microsoft's record lists 9.6 (scope changed), so check NVD before reporting a score. Microsoft states that the fix is applied in the cloud and that no customer action is required. Exploitation needs a valid low-privilege account and no user interaction, and the impact depends on what the agent can access.
Microsoft · Azure SRE Agent
SimpleChat, an AI chat application with group workspaces, does not safely render group document filenames in the Share action of the group workspace. An authenticated group Owner, Admin or DocumentManager can upload a document with a crafted filename. When another group member clicks Share on that document, the injected script runs in the SimpleChat origin with the victim's session, so it can access data and perform actions the victim is allowed to use. The CNA rates the CVSS 3.1 base score at 8.7 (High), and NVD analysis is still pending.
Microsoft · SimpleChat
SimpleChat, an AI conversation application with personal and group workspaces, contains an authorization ordering flaw in the endpoint for saving user plugins. An authenticated low-privileged user can register a personal MCP action with the stdio transport by omitting the top-level type field, which bypasses the check that restricts stdio to administrator-managed global actions. When an agent invokes a tool of this action, the application starts an attacker-chosen operating system process under the application's service identity. Exploitation requires personal plugins to be enabled and governance to permit MCP actions. An attacker could access secrets and data available to the service or disrupt the service.
Microsoft · SimpleChat
Kiota, an OpenAPI-based HTTP client code generator, does not fully neutralize block-comment terminators in its Java and PHP generators. Attacker-controlled text in an OpenAPI description can reform a comment terminator and place code outside a generated documentation comment. Exploitation requires a developer or build pipeline to generate code from the malicious description and then compile and load the Java output or load the PHP output.
Microsoft · Kiota
MsQuic clients using the OpenSSL or QuicTLS TLS backend do not verify that the server certificate matches the intended target hostname. An on-path attacker can present a certificate for another hostname and impersonate the server in a man-in-the-middle attack. The Schannel backend is not affected.
Microsoft · MsQuic
Microsoft UFO, an open-source automation framework, passes an unvalidated key_code parameter of the Mobile MCP press_key tool to 'adb shell input keyevent'. An authenticated caller can inject additional shell commands that run as the Android shell user on an authorized, connected Android device. Exploitation requires a valid UFO_MCP_API_KEY, adb on the host and a reachable authorized device; it does not grant host OS or Android root access.
Microsoft · UFO
Microsoft UFO, an open-source framework for automation across devices and platforms, is affected by a deadlock in the /api/task_result/{task_name} endpoint. The session manager acquires a non-reentrant lock twice when a task name maps to a session. An authenticated user who knows or creates such a task name can block the request indefinitely. In the default single-process server configuration, the blocked event loop also stops other HTTP and WebSocket interactions. Unknown task names are not affected.
Microsoft · UFO
Microsoft UFO, an open-source framework for agents that automate a Windows desktop, is affected before version 3.0.9. The run_shell tool only checks the first token of a command and allows explorer.exe, which passes its path argument to ShellExecute, so an attacker-influenced agent call can start an arbitrary executable or script as the logged-in user. Exploitation requires a user to run an affected agent workflow and an induced tool call, but successful execution can access or modify that user's files, tokens and sessions.
Microsoft · UFO
Microsoft UFO before 3.0.9 contains a Server-Side Request Forgery (SSRF) flaw in the Galaxy device registration. An attacker with a valid account that can call the device registration API can supply a WebSocket endpoint that redirects connections to internal hosts reachable from the UFO server. The confirmed impact is limited to opening an internal connection and sending a WebSocket handshake request; response data, arbitrary HTTP methods and cloud metadata access are not established.
Microsoft · UFO
Microsoft UFO passes caller-supplied text and package names from the Mobile MCP tools type_text and launch_app into adb shell commands without comprehensive validation. An attacker with a valid Mobile MCP API key and access to a reachable, ADB-authorised Android device can inject shell metacharacters to run additional commands. The impact is limited to the Android shell user on that device; the advisory does not claim host operating-system or root access.
Microsoft · UFO
Microsoft Exchange Server 2016 CU23, 2019 CU14 and CU15, and Subscription Edition RTM are affected by a flaw that lets an authenticated attacker access other users' mailboxes within the same organization. The attacker can read email messages and attachments. Exploitation requires a valid account on the Exchange organization, and according to Microsoft the flaw does not allow access across tenant boundaries. CVSS 8.8 (High).
Microsoft · Exchange Server
