Microsoft Cloud Service Vulnerabilities

Three critical vulnerabilities have been identified in the Microsoft Partner Center, Microsoft Bookings, and Microsoft Dataverse services that could allow unauthorized remote threat actors to escalate privileges or execute code, potentially compromising the confidentiality, integrity, and availability of the affected environments. Affected Products - Microsoft Partner Center: cloud service; specific versions not applicable. - Microsoft Bookings: cloud service; specific versions not applicable. - Microsoft Dataverse: cloud service; specific versions not applicable. Impact The vulnerabilities have been identified as: - CVE-2026-96207: with a CVSS v3.1 score of 10.0. There is an inadequate certificate validation vulnerability that could allow a malicious actor to escalate their privileges within a network. - CVE-2026-94510: with a CVSS v3.1 score of 9.9. There is an authorization bypass vulnerability using a user-controlled key in Microsoft Bookings that could allow an unauthorized malicious actor to escalate their privileges on a network. - CVE-2026-88131: with a CVSS v3.1 score of 9.8. There is an untrusted data deserialization vulnerability in Microsoft Dataverse that could allow an unauthenticated remote malicious actor to execute arbitrary code over the network. Recommendation - Check the official advisories from the Microsoft Security Response Center (MSRC) to confirm the remediation status of each vulnerability and the required actions for customers. - Since the affected products are managed cloud services, the fixes for their internal components primarily belong to Microsoft. References - https://nvd.nist.gov/vuln/detail/CVE-2026-96207 - https://nvd.nist.gov/vuln/detail/CVE-2026-94510 - https://nvd.nist.gov/vuln/detail/CVE-2026-88131 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96207 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-94510 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-88131