Microsoft Security Updates – 10 May 2026

The addressed vulnerabilities could allow the attacker to obtain sensitive information, conduct spoofing attacks, execute arbitrary code, or gain elevated privileges on the affected systems.

Sample of the addressed vulnerabilities:

1. Microsoft Azure DevOps Information Disclosure Vulnerability (CVE-2026- 42826):

• CVSS: 10.0
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Obtain Information

2. Microsoft Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability (CVE-2026-33109):

• CVSS: 9.9
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Remote Code Execution

Sample of the affected products:

• Azure DevOps.
• Microsoft Teams.
• Microsoft Enterprise Security Token Service (ESTS).
• Azure Managed Instance for Apache Cassandra.
• Copilot Chat (Microsoft Edge).
• Microsoft 365 Copilot’s Business Chat.