Microsoft Fixes 18 Azure and Copilot Flaws, Urges Windows Update

Microsoft has released fixes for 18 vulnerabilities across its Azure cloud portfolio and Copilot-branded AI products. Most were elevation-of-privilege flaws affecting Azure ARC, Azure AI Foundry, Azure Logic Apps, Azure Billing, Azure HorizonDB, Azure Cosmos DB, Azure Container Registry, Microsoft Fabric, Microsoft Dataverse and Microsoft 365 Copilot.

The update also addressed information-disclosure vulnerabilities in Copilot, Microsoft 365 Copilot, Microsoft 365 Copilot Business Chat and Azure Machine Learning, plus a spoofing vulnerability in Azure Portal.

Microsoft rated all 18 issues as critical, although their CVSS scores classify some as high or medium severity. The company said several flaws were identified internally, while many were reported by external researchers. None has been flagged as exploited. Microsoft also said all fixes were applied server-side, so customers do not need to take action for these Azure and Copilot vulnerabilities.

Separately, Microsoft disclosed a Windows privilege-escalation vulnerability tracked as CVE-2026-85921. Unlike the cloud and AI fixes, users must install a Windows update to address this issue. Microsoft considers exploitation of the Windows vulnerability “less likely”.