Posts

🟠 High | Source: Microsoft Security Response Center CVE-2026-34191 is a SQL injection vulnerability in the Apache Portable Runtime Utility (APR-util) library, specifically affecting its Oracle database driver (apr_dbd_oracle). SQL injection flaws allow attackers to manipulate database queries, potentially exposing or corrupting data. Microsoft has published this advisory in relation to Azure, suggesting the vulnerability may affect Azure services or components that rely on this open-source library. Security Architect’s Take: Identify any Azure workloads or self-managed components that use APR-util with Oracle database backends — particularly Apache HTTP Server deployments — and apply available patches promptly. Additionally, review whether any Azure-managed services flagged in Microsoft’s update guide require platform-side remediation or configuration changes. ...

🟠 High | Source: Microsoft Security Response Center CVE-2025-49506 is a timing attack vulnerability in the Apache Portable Runtime Utility (APR-util) library, specifically in the apr_password_validate() function used to verify passwords. By measuring how long the function takes to respond, an attacker could potentially deduce valid passwords or credentials without direct access. This matters because APR-util is widely embedded in many server-side applications and services, including those running on Azure. Security Architect’s Take: Identify any Azure-hosted workloads or services relying on Apache APR-util and prioritise patching to the remediated version as soon as it is available; additionally, review whether network-level controls or rate limiting can reduce an attacker’s ability to conduct timing measurements against exposed authentication endpoints. ...

🟠 High | Source: The Hacker News Atlassian’s AI assistant Rovo can be manipulated via prompt injection attacks to exfiltrate Jira and Confluence data accessible to a signed-in user, sending it to an attacker-controlled server. Two independent security firms discovered separate attack routes; at least one remains unpatched. This is a significant risk for organisations using Rovo across sensitive project management and documentation platforms. Security Architect’s Take: Review and restrict Rovo’s access to sensitive Jira projects and Confluence spaces immediately, and audit what external content Rovo is permitted to read. Consider disabling Rovo in high-sensitivity environments until Atlassian confirms all identified attack vectors are fully remediated. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-55995 is a double-free memory corruption vulnerability in the iSNS (Internet Storage Name Service) attribute decoder within open-iscsi, an open-source iSCSI initiator used to connect systems to storage over IP networks. Double-free flaws occur when a programme attempts to free the same memory region twice, which can lead to arbitrary code execution or a system crash. This is particularly relevant in cloud and virtualised environments where iSCSI-based block storage is commonly used. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-44944 is an authentication bypass vulnerability in iscsiuio, a component of the open-iscsi package used to manage iSCSI storage connections via a control socket. An attacker able to reach the control socket could bypass authentication and interact with the service without valid credentials. This is relevant to Azure environments where Linux VMs use iSCSI-based storage, as exploitation could allow unauthorised control over storage connectivity. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-44943 is a vulnerability in open-iscsi, the Linux iSCSI initiator, that allows a remote attacker to perform a limited file-write operation as root via the discovery process. This affects Azure workloads running Linux virtual machines or containers that use open-iscsi for storage connectivity. The ability to write files as root, even in a limited capacity, could be leveraged to escalate privileges, persist malware, or disrupt storage-attached workloads. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-6879 describes a quadratic time complexity flaw in Python’s xml.etree.ElementPath when processing index predicates in XPath expressions. An attacker able to supply crafted XML input could trigger excessive CPU consumption, leading to a denial-of-service condition. This is relevant to Azure services and workloads that parse XML using Python’s standard library. Security Architect’s Take: Audit any Azure-hosted applications or functions that accept untrusted XML input and process it via Python’s xml.etree ElementPath — apply vendor patches promptly and consider input size and complexity limits as a defence-in-depth measure. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-32597 is a vulnerability in the PyJWT library where it incorrectly accepts unknown ‘crit’ (critical) header extensions in JSON Web Tokens, violating a mandatory requirement in the JWT/JWS specification (RFC 7515 §4.1.11). This means an attacker could craft a JWT containing unrecognised critical headers that should be rejected, potentially bypassing validation logic in applications relying on PyJWT for authentication or authorisation. Any Azure or cloud-hosted application using PyJWT to validate tokens may be at risk if the consuming application assumes unrecognised critical extensions are properly enforced. ...

🟠 High | Source: Microsoft Security Response Center CVE-2026-48524 is a denial-of-service vulnerability in PyJWT’s JWKClient, which fetches public keys from a remote JWKS endpoint to verify JSON Web Tokens. An attacker can craft JWT tokens containing arbitrary ‘kid’ (key ID) values, causing the client to make unbounded outbound HTTP requests to the JWKS endpoint and potentially exhausting resources or triggering rate-limiting. Any Azure-hosted application using PyJWT’s JWKClient for token validation may be vulnerable to service disruption. ...

🟠 High | Source: Microsoft Security Response Center A path traversal vulnerability has been identified in Docker Compose, exploitable via maliciously crafted OCI artifact layer annotations. An attacker could potentially use this flaw to write files outside of intended directories during the handling of OCI artefacts, which may lead to arbitrary file writes on the host system. This is particularly concerning in CI/CD pipelines and containerised environments where Docker Compose is widely used. ...