[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fF6Hz0TZiyo7SreT5fwmbQ-AL7qMN7uvFJfC94XA2D_c":3},{"article":4,"iocs":40},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":32,"category":33,"article_tags":37},"90138799-6bbe-4cf7-85da-40d711287330","Microsoft Rolls Out 22 Fresh Security Patches","microsoft-rolls-out-22-fresh-security-patches-881dd1","Most of the fixes resolve code execution, privilege escalation, and information disclosure vulnerabilities. The post Microsoft Rolls Out 22 Fresh Security Patches appeared first on SecurityWeek.","Microsoft has released 22 security updates, addressing critical and high-severity vulnerabilities across various products like Azure, Entra ID, and Exchange. Ten of these flaws are rated with a CVSS score of 10\u002F10, including elevation of privilege and remote code execution vulnerabilities. While most server-side mitigations are already deployed, users should still review and apply the necessary patches.","Microsoft releases 22 security updates, including 10 critical vulnerabilities.","Microsoft on Thursday announced the rollout of 22 new security updates that resolve severe vulnerabilities across multiple products. Most of the patches address critical and high-severity flaws in Microsoft Azure, Entra ID, Exchange, Fabric, and Partner Center products. The most severe of these include elevation of privilege (EoP) bugs in Azure SQL Database (CVE-2026-69502), Azure Arc (CVE-2026-69555 and CVE-2026-65816), and Exchange Online (CVE-2026-65801), and remote code execution (RCE) flaws in Azure Managed Instance for Apache Cassandra (CVE-2026-65770), and Entra ID (CVE-2026-69836), all with a CVSS score of 10\u002F10. Seven other critical EoP issues were resolved: CVE-2026-68782 (Azure SQL Database), CVE-2026-63509 (Microsoft Fabric), CVE-2026-69851 (Entra ID), CVE-2026-68789 (Azure SQL Database), CVE-2026-69400 (Azure Logic Apps), CVE-2026-62834 (Azure Data Factor), and CVE-2026-66309 (Azure SQL Database). Additionally, Microsoft patched high-severity vulnerabilities in Azure Virtual Machines, Microsoft Partner Center, Azure Data Factory, Azure Stack HCI, Azure Data Manager for Energy, Copilot in Azure, and Windows Remote Help Defense. No customer action is required for the majority of these security defects, as Microsoft has deployed the mitigations on the server side.Advertisement. Scroll to continue reading. Earlier this week, Microsoft fixed a high-severity command injection bug in Copilot that could be exploited remotely for information disclosure (CVE-2026-24301). Last week, the company announced that it was working on patches for ShieldBreak, a zero-day Defender exploit dropped on August 2026 Patch Tuesday by security researcher Nightmare Eclipse (also known as Chaotic Eclipse). The company assesses that the vulnerability ShieldBreak targets is a high-severity bug, now tracked as CVE-2026-69414 (CVSS score of 7.8). “Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as ‘ShieldBreak’. We are working to provide a high-quality security update that addresses this vulnerability,” the company said. Related: CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities Related: Exploitation Expected for Critical Authentication Bypass Patched in Citrix NetScaler Related: Critical GitLab Flaw Exploited Shortly After Disclosure Related: CISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Cisco Patches Critical Crosswork, Secure Workload VulnerabilitiesExploitation Expected for Critical Authentication Bypass Patched in Citrix NetScalerCritical GitLab Flaw Exploited Shortly After DisclosurePrevalent AI Raises $22 Million to Expand Data Fabric PlatformUS Charges 17 Iranian Hackers, Offers $10 Million Rewards for 5 of ThemCISA Urges Immediate Patching of Exploited Microsoft, VMware, Apple Vulnerabilities943 Patches Rolled Out With Oracle’s August 2026 Security UpdateChrome, Firefox Updates Patch Dozens of Vulnerabilities Latest News Rust Supply Chain Attack Linked to North Korean HackersContractors’ CMMC Confidence Rises as Ability to Prove It Falls BehindCISA Urges Immediate Patching of Exploited TrueConf VulnerabilitiesHackers Target Zimbra Servers in Active Exploitation CampaignSurveillance – Everything You Wanted to Know, But Were Afraid to AskThreat Actor Hacks 14,000 IP Cameras in Ukraine and RussiaAtlassian, Splunk Patch Dozens of Critical, High-Severity VulnerabilitiesMLflow Vulnerability Exploited for Cloud Credential Theft Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MoveDaniel Dubowski has been named Senior Vice President and Chief Information Security Officer at Marriott International.Allied Universal has named Jordan Avnaim Global Chief Information Security Officer.Cycode has promoted Seth Robbins to President and Chief Revenue Officer.More People On The MoveExpert Insights The AI Governance Gap Is a Leadership Problem: Waiting Won’t Close It Organizations are rushing to implement AI without fully grasping where its legal protections begin and end. (Steve Durbin) Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Flipboard Reddit Whatsapp Whatsapp Email","https:\u002F\u002Fwww.securityweek.com\u002Fmicrosoft-rolls-out-22-fresh-security-patches\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F10\u002FMicrosoft.jpeg","2026-08-21T08:12:19+00:00","2026-08-21T10:00:26.062737+00:00",9,[18,21,24,26,28,30],{"name":19,"type":20},"Microsoft","vendor",{"name":22,"type":23},"Microsoft Azure","product",{"name":25,"type":23},"Entra ID",{"name":27,"type":23},"Exchange Online",{"name":29,"type":23},"Microsoft Defender",{"name":31,"type":23},"Copilot","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},[41,45,48,50,53,56,59,61,64,67,69,72,75,77,80],{"type":42,"value":43,"context":44},"cve","CVE-2026-69502","Elevation of privilege in Azure SQL Database",{"type":42,"value":46,"context":47},"CVE-2026-69555","Elevation of privilege in Azure Arc",{"type":42,"value":49,"context":47},"CVE-2026-65816",{"type":42,"value":51,"context":52},"CVE-2026-65801","Elevation of privilege in Exchange Online",{"type":42,"value":54,"context":55},"CVE-2026-65770","Remote code execution in Azure Managed Instance for Apache Cassandra",{"type":42,"value":57,"context":58},"CVE-2026-69836","Remote code execution in Entra ID",{"type":42,"value":60,"context":44},"CVE-2026-68782",{"type":42,"value":62,"context":63},"CVE-2026-63509","Elevation of privilege in Microsoft Fabric",{"type":42,"value":65,"context":66},"CVE-2026-69851","Elevation of privilege in Entra ID",{"type":42,"value":68,"context":44},"CVE-2026-68789",{"type":42,"value":70,"context":71},"CVE-2026-69400","Elevation of privilege in Azure Logic Apps",{"type":42,"value":73,"context":74},"CVE-2026-62834","Elevation of privilege in Azure Data Factor",{"type":42,"value":76,"context":44},"CVE-2026-66309",{"type":42,"value":78,"context":79},"CVE-2026-24301","Command injection and information disclosure in Copilot",{"type":42,"value":81,"context":82},"CVE-2026-69414","ShieldBreak zero-day vulnerability in Microsoft Defender"]