Multiple Vulnerabilities Disclosed in Golang Go and Microsoft Azure Services
Germany's dCERT published advisories for multiple vulnerabilities affecting Golang Go and several Microsoft Azure services, including Azure DevOps, Data Factory, and Cloud Shell. The Go advisory states that multiple flaws could allow an unspecified attack, indicating potential security impact in applications or environments that rely on the language runtime and related components.
A separate dCERT advisory reported multiple vulnerabilities in Microsoft's cloud platform components, expanding the scope of exposure to development, automation, and shell-access services in Azure. While technical details and exploit conditions were not provided in the advisories, the disclosures indicate that organizations using these technologies should review vendor guidance, identify affected deployments, and prioritize remediation once patches or mitigations are available.
Timeline
Apr 8, 2026
dCERT publishes advisory 2026-0988 for Golang Go vulnerabilities
dCERT published advisory 2026-0988 covering multiple vulnerabilities in Golang Go. The reference provides no synopsis or additional technical details.
Mar 20, 2026
dCERT publishes advisory 2026-0777 for Microsoft Azure services
dCERT published advisory 2026-0777 covering multiple vulnerabilities affecting Microsoft Azure DevOps, Data Factory, and Cloud Shell. The reference does not include additional details on impact or remediation.
Feb 27, 2026
dCERT publishes advisory 2026-0538 for Golang Go vulnerabilities
dCERT published advisory 2026-0538 بشأن multiple vulnerabilities in Golang Go that could allow unspecified attacks. No further synopsis or technical details were provided in the reference.
Jan 1, 2026
dCERT publishes advisory 2025-2064 for Golang Go vulnerabilities
dCERT published advisory 2025-2064 covering multiple vulnerabilities in Golang Go. The reference provides no synopsis or additional technical details.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Organizations
Affected Products
Sources
Related Stories
Multiple Microsoft Azure Vulnerabilities Enable Privilege Escalation
Germany's dCERT published two advisories covering **multiple vulnerabilities in Microsoft Azure**, with the later notice stating that the flaws can allow **privilege escalation**. The advisories identify Azure as the affected platform but provide no public synopsis, indicating only that several security issues were addressed across the cloud service. The paired notices suggest an evolving disclosure in which Microsoft Azure vulnerabilities were first reported broadly and then updated with a more specific impact assessment tied to elevated privileges. Organizations using Azure should review the corresponding vendor guidance and remediation information for the affected services, prioritize patching, and assess whether exposed identities, roles, or cloud resources could be affected by unauthorized privilege gains.
1 weeks ago
Microsoft Discloses Multiple Critical Cloud and AI Service Vulnerabilities
Microsoft published several **critical** security advisories affecting cloud and AI services, including **Azure Cloud Shell**, **Azure DevOps**, **Azure Data Factory**, **Microsoft Copilot**, **M365 Copilot**, **Microsoft 365 Copilot BizChat**, **Microsoft Bing**, and **Bing Images**. The issues span **elevation of privilege**, **information disclosure**, **tampering**, and **remote code execution**, with listed weakness classes including **SSRF** (`CWE-918`), **insufficiently protected credentials** (`CWE-522`), **sensitive information exposure** (`CWE-200`), and **command injection** (`CWE-77`/`CWE-78`). Several advisories state that the vulnerabilities **require no customer action to resolve**, indicating Microsoft-managed remediation for affected online services. The most severe disclosures include **CVE-2026-32169** in *Azure Cloud Shell* with a **CVSS 10.0** elevation-of-privilege rating, **CVE-2026-32191** in *Microsoft Bing Images* with a **CVSS 9.8** remote code execution rating, and high-impact flaws in *Azure DevOps* (**CVE-2026-23658**), *Azure Data Factory* (**CVE-2026-23659**), and *Microsoft 365 Copilot BizChat* (**CVE-2026-26137**). Separate advisories also cover information disclosure in *Microsoft Copilot* (**CVE-2026-26136**) and *M365 Copilot* (**CVE-2026-24299**), plus a tampering flaw in *Microsoft Bing* (**CVE-2026-26120**). A separate report on the **RegPwn** Windows Registry privilege-escalation bug (**CVE-2026-24291**) describes a different issue in Windows accessibility and Secure Desktop handling and is not part of the same Microsoft cloud-service disclosure set.
1 weeks ago
Microsoft Discloses Critical Azure MCP Server and AKS Authentication Flaws
Microsoft disclosed two high-severity vulnerabilities affecting hosted Azure services: **CVE-2026-32211** in **Azure MCP Server** and **CVE-2026-33105** in **Azure Kubernetes Service (AKS)**. The Azure MCP Server issue is an information disclosure flaw tied to **missing authentication for a critical function** (`CWE-306`), allowing an unauthenticated attacker to access sensitive information over the network. Its CVSS v3.1 vector, `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`, indicates remote exploitation with no privileges or user interaction required. Microsoft also published **CVE-2026-33105**, an **improper authorization** vulnerability in AKS mapped to `CWE-285`, which could let an unauthenticated attacker **elevate privileges** remotely. The CVSS v3.1 vector, `AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`, reflects potential high impact across confidentiality, integrity, and availability. Both entries were identified as affecting **exclusively hosted services** and point defenders to Microsoft’s MSRC advisories for service-specific remediation and exposure assessment.
1 months ago