Microsoft Fixes Privilege Escalation and Spoofing Flaws in Azure Databricks and Cloud Services

Microsoft disclosed three cloud-service vulnerabilities affecting Azure Databricks, Microsoft Purview eDiscovery, and Microsoft Entra ID Entitlement Management. The issues are tracked as CVE-2026-33107, an elevation-of-privilege flaw in Azure Databricks; CVE-2026-26150, an elevation-of-privilege flaw in Microsoft Purview eDiscovery; and CVE-2026-35431, a spoofing flaw in Microsoft Entra ID Entitlement Management. Microsoft published the advisories through its Security Update Guide, indicating that multiple enterprise cloud components required security attention at the same time.

The affected products span analytics, compliance, and identity governance functions that are widely used in Microsoft-centric environments. While Microsoft provided limited public technical detail in the advisories, the vulnerability classifications indicate potential risks including unauthorized privilege gains in Databricks and Purview workflows, as well as identity or trust abuse scenarios involving Entra ID Entitlement Management. Organizations using these services should review the relevant Microsoft advisories, assess exposure in tenant configurations, and apply available mitigations or service updates through normal cloud security and change-management processes.