VulnSocial

CVE-2026-69854Patch(microsoft / spring_cloud)

LOWCVSS 8.1 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch microsoft spring_cloud systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network.

microsoft CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-287

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • spring_cloud

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Peaked 1d ago at 1 mentions (2026-09-09); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
microsoft
Products
spring_cloud

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-09: 1Mentions · 2026-09-14: 1Patch / Workaround · 2026-09-09: 1Patch / Workaround · 2026-09-14: 1Technical Details · 2026-09-09: 1Technical Details · 2026-09-14: 109-0909-14
Signal classification1 categories
Patch
2100.0%
Referenced assets1 URL
Full discourse2 posts
  • Rıdvan Yağlı@ridvanyagli
    Patch

    🔴 Spring Cloud Azure'da kritik kimlik doğrulama açığı: CVE-2026-69854 Spring Cloud Azure'da CWE-287 Improper Authentication olarak takip edilen CVE-2026-69854, ağ üzerinden uzaktan istismar edilerek yetki yükseltmeye yol açabiliyor. Açık için CVSS 3.1 skoru 9.0 (Critical) olarak değerlendiriliyor ve kimlik doğrulama gerektirmeden istismar edilebildiği belirtiliyor. Spring Cloud Azure 7.3.x ve önceki sürümler etkilenirken, 7.4.0 sürümünde düzeltildi. Öneri: Spring Cloud Azure kullanan uygulamalarda sürüm kontrolü yapılarak 7.4.0 veya üzeri sürüme güncelleme yapılmalı.

    Post summary

    CVE-2026-69854 is a critical remote improper authentication flaw in Spring Cloud Azure that can be exploited without authentication; it is fixed in version 7.4.0, so updating to that or newer releases mitigates the risk.

    00071588
    2.4K followersView on X
  • NEXSIGHT@NEXSIGHTNEWS
    Patch

    Microsoftの9月更新、Azure関連の脆弱性3件を修正 — Spring Cloud Azureの権限昇格はCVSS 9.0、修正版は7.4.0 https://cyber.nexsight.co/articles/2026/09/14/microsoft-azure-cve-2026-69854-spring-cloud-azure-arc-cyclecloud-2026-09-14/

    Post summary

    Microsoft’s September update fixes three Azure‑related vulnerabilities, including a privilege escalation in Spring Cloud Azure (CVSS 9.0), with the corrected version 7.4.0. No PoC, exploit code, or evidence of active exploitation is mentioned.

    0000058
    70 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appmicrosoftspring_cloud-azure-

Explore more

Back to dashboardmicrosoft CVEsspring_cloud vulnerabilities