Two perfect 10s in Azure SQL and Teams, plus a 9.9 in Service Bus
Microsoft dropped three near-max-severity bugs today: an auth bypass in Azure SQL Database (CVSS 10.0), a missing authz check in Teams (CVSS 10.0), and a deserialization RCE in Azure Service Bus (CVSS 9.9). Dell and Chrome round out the list, but the Microsoft trio is the fire drill.
Two perfect 10.0s from Microsoft dropped today, and neither one needs authentication. CVE-2026-56162 is an auth bypass in Azure SQL Database, and CVE-2026-65667 is a missing authorization check in Teams that lets an attacker escalate privileges over the network. Neither is exploited in the wild yet, but scores like these don't stay theoretical for long. Five total CVEs today, all high severity or above.
Today's CVEs
Sorted by urgencyCVE-2026-50515
NVDAn attacker with any level of authorization on Azure Service Bus can send crafted serialized data to execute arbitrary code remotely. The bug is a deserialization flaw, meaning the service trusts incoming data it shouldn't, and the CVSS 9.9 reflects how little effort it takes once you have basic access. No reports of exploitation in the wild yet, but that score demands fast action.
- Affected estate
- Anyone using Azure Service Bus in their environment, whether directly or through apps that depend on it
- How to check
- Review your Azure Portal for active Service Bus namespaces. Check your application dependencies for the Azure Service Bus SDK and compare versions against Microsoft's advisory.
- Included because
- network-exploitable; low barrier (authorized user); CVSS 9.9; common cloud service
- Action
- Apply the patch or SDK update published by Microsoft. If a client library update is required, rebuild and redeploy affected applications.
- Why it matters
- A low-privilege attacker can run arbitrary code on the service, which could expose message data and pivot into connected systems.
- Source
- Microsoft Security Response Center
Evidence trail
- NVD: View source
CVE-2026-67261
NVDAn unauthenticated attacker can hit the IAPI component of Dell Virtual Storage Integrator for VMware vSphere Client and inject OS commands that run as root. No credentials needed, no user interaction. A successful exploit hands over full control of the underlying server and anything it manages.
- Affected estate
- VMware vSphere admins running Dell Virtual Storage Integrator versions prior to 10.11.1.0
- How to check
- Open the vSphere Client, find the Dell VSI plugin, and check the version. Anything below 10.11.1.0 is vulnerable.
- Included because
- unauthenticated; remote; root-level execution; CVSS 9.8; internet-reachable component
- Action
- Upgrade to Dell VSI 10.11.1.0 or later. Until patched, firewall off the IAPI endpoint from untrusted networks.
- Why it matters
- Unauthenticated root-level code execution means an attacker can own your storage integration layer and potentially your entire VMware infrastructure.
- Source
- Dell Security Advisory
Evidence trail
- NVD: View source
CVE-2026-19169
NVDA bug in Chrome's Contextual Tasks feature lets an attacker escalate privileges if a user visits a malicious page. It takes user interaction (clicking a link or loading a page), but once triggered, the attacker gains elevated access. Chromium rates this High severity.
- Affected estate
- Anyone running Google Chrome or Chromium-based browsers (Edge, Brave, etc.) on any platform, prior to version 151.0.7922.109
- How to check
- Run chrome://version in the address bar or query your endpoint management tool for Chrome versions below 151.0.7922.109.
- Included because
- CVSS 8.8; privilege escalation via crafted webpage; widely deployed browser; user interaction required but trivially achieved
- Action
- Push Chrome 151.0.7922.109 or later through your browser management policy or software update tool.
- Why it matters
- A single malicious webpage can escalate privileges on the user's machine, making this a prime phishing vector.
- Source
- Google Chrome Releases / Chromium Security Advisory
Evidence trail
- NVD: View source
CVE-2026-56162
NVDAzure SQL Database has an authentication bypass that lets a completely unauthorized attacker elevate privileges over the network. CVSS 10.0, no authentication needed. Microsoft hasn't shared many details yet, but the score and description tell you everything: this is as bad as it gets for a managed database service.
- Affected estate
- Anyone with Azure SQL Database instances, whether single databases, elastic pools, or managed instances
- How to check
- Review the Azure Portal for active SQL Database instances. Check Microsoft's advisory for version or configuration details that confirm exposure.
- Included because
- unauthenticated; network-exploitable; CVSS 10.0; widely used cloud database service
- Action
- Apply Microsoft's fix or confirm the platform-side patch has rolled out to your instances. Review database access logs for anomalous privilege escalation.
- Why it matters
- An unauthenticated attacker gaining elevated privileges on your database service could read, modify, or destroy all your data.
- Source
- Microsoft Security Response Center
Evidence trail
- NVD: View source
CVE-2026-65667
NVDMicrosoft Teams has a missing authorization check that lets an unauthorized attacker escalate privileges over the network. CVSS 10.0, no authentication required. Given how widely Teams is deployed, this is a top-priority fix even without confirmed exploitation in the wild.
- Affected estate
- Anyone using Microsoft Teams, whether desktop, web, or mobile clients, and Teams service admins
- How to check
- In the Teams desktop client, go to Settings > About to check the version. Use your endpoint management tool to query Teams versions across your fleet. Compare against the patched version in Microsoft's advisory.
- Included because
- unauthenticated; network-exploitable; CVSS 10.0; extremely common product across enterprises
- Action
- Push the latest Teams update through Microsoft 365 Apps admin center or your endpoint management platform. Confirm the update has landed on all managed devices.
- Why it matters
- An unauthenticated privilege escalation in a tool used by nearly every employee means an attacker could gain access to chats, files, and connected services at scale.
- Source
- Microsoft Security Response Center
Evidence trail
- NVD: View source
One email, every Wednesday morning.
SubscribeFrom the field notes
From this beat
Read the rest of the field notes →