microsoftCVE-2026-83946

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network.

High8.2CVE-2026-83946 · Published Sep 18, 2026 · updated Sep 25, 2026

Affected versions

Package	Affected	Fixed in
Azure Portal Vendor	all versions	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Severity from: no source yet
Weakness: CWE-79

More microsoft advisories

All

Date	Advisory	Severity	Fixed in
Sep 18	Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network. CVE-2026-62874Critical10.0no fix yet	Critical10.0	No fix yet
Sep 18	Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network. CVE-2026-69843Critical10.0no fix yet	Critical10.0	No fix yet
Sep 18	Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network. CVE-2026-85878Critical9.9no fix yet	Critical9.9	No fix yet
Sep 18	Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network. CVE-2026-85887High7.7no fix yet	High7.7	No fix yet
Sep 17	Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network. CVE-2026-85885Critical9.9no fix yet	Critical9.9	No fix yet
Sep 17	Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. CVE-2026-85889Critical10.0no fix yet	Critical10.0	No fix yet

Affected versions

More microsoft advisories

Critical advisories by email