Microsoft discloses two CVSS 10.0 Azure zero-days: missing auth in AI Language and Entra B2C auth bypass
On September 3 Microsoft disclosed CVE-2026-70352 (missing authentication in Azure AI Language Authoring) and CVE-2026-83711 (authorization bypass in Entra ID B2C). Both score CVSS 10.0. Server-side fixes are deployed; customers need take no action but should review activity logs.
On September 3 Microsoft disclosed two CVSS 10.0 Azure cloud zero-days: CVE-2026-70352 (missing authentication on a critical Azure AI Language Authoring function) and CVE-2026-83711 (authorization bypass in Azure AD B2C, now Entra ID, via a user-controllable key). Unlike on-prem products, Microsoft completed server-side fixes; customers do not install patches.
Incident overview
CVE-2026-70352 sits in Azure AI Language Authoring (create/train). It is missing authentication on a critical function (CWE-306): an attacker can reach protected admin functions with no credentials. CVE-2026-83711 is an authorization bypass on the Entra ID B2C customer-identity platform: a user-controllable key (IDOR-class) grants access to other tenants' resources, a direct threat to B2C tenants that hold large C-end identity stores. Both were patched on the cloud side. MSRC published advisories. This is a separate issue from the Entra ID deserialization bug CVE-2026-69836 reported on this site on September 1.
Technical details
Cloud zero-days follow a different fix model than on-prem software. Microsoft operates the control plane; bugs can be patched silently server-side and take effect for all customers immediately. Both 10.0 issues were mitigated server-side before disclosure—the advantage of the cloud security model. The other side: customers have zero visibility and zero control over the fix, and must trust the vendor's patch and disclosure cadence. For audit and compliance teams, vendor-side-fixed bugs typically never appear in any customer asset inventory. Coverage requires continuous tracking of MSRC advisories.
Impact assessment
Both score 10.0, but cloud-side fixes compressed the live exposure window. Residual risk is the pre-disclosure exploit window: if an attacker hit Authoring resources or B2C tenant data before the fix landed, customers have little chance of detecting it after the fact. Microsoft advises customers to confirm services are updated and to backtrack activity logs for anomalous access before the fix.
Remediation
- Confirm Azure AI Language and Entra ID B2C service health. No customer-side patch.
- Retroactively audit activity logs: Authoring operations on Azure AI Language resources and anomalous authorization events on B2C tenants, with emphasis on suspicious access before disclosure.
- Apply least-privilege API permissions and Conditional Access on B2C tenants to shrink blast radius if an authz bug is exploited.
- Subscribe to MSRC advisories and fold cloud-service vuln tracking into routine threat intel.
References
- MSRC: CVE-2026-70352 advisory
- MSRC: CVE-2026-83711 advisory
- ThreatAft: analysis of the two CVSS 10.0 Azure zero-days