Microsoft published fixes on August 6 for four separate vulnerabilities that each carry the maximum-practical CVSS score of 9.9, spread across core Azure messaging infrastructure, Microsoft’s own AI-driven SRE tooling, Entra ID’s identity provisioning pipeline, and on-premises Active Directory. None of the four share a root cause, but all four are remotely exploitable and land in components that sit at the center of enterprise cloud and identity infrastructure — which is what pushes an otherwise routine patch batch into “patch immediately” territory rather than the usual monthly cadence.

The four flaws

CVE-2026-50515 — Azure Service Bus RCE (CVSS 9.9). A deserialization-of-untrusted-data bug lets an authorized attacker execute arbitrary code over the network. Service Bus is Microsoft’s managed enterprise message broker, wired into everything from order-processing pipelines to inter-service communication in Azure-hosted SaaS products; an attacker who can reach the message plane with any authorized identity — a compromised low-privilege service account, a leaked SAS token — can turn message payloads into remote code execution on the broker side.

CVE-2026-62830 — Azure SRE Agent EoP (CVSS 9.9). A missing-authorization check in Azure SRE Agent, Microsoft’s newer agentic tooling for automated incident response and infrastructure remediation, lets an authorized attacker elevate privileges over the network. Because SRE Agent is explicitly designed to take remediation actions against production infrastructure, a privilege-escalation bug here is functionally a path to whatever the agent itself is authorized to touch — potentially spanning multiple resource groups or subscriptions depending on how the agent’s identity was scoped.

CVE-2026-59115 — Entra Provisioning Service (SyncFabric) EoP (CVSS 9.9). An authorized attacker can elevate privileges over the network through Entra ID’s provisioning service, the backend responsible for syncing users, groups, and roles between on-prem AD, Entra ID, and downstream SaaS applications. Provisioning pipelines routinely run with directory-wide write access, so a flaw that lets a lower-privileged identity escalate inside that pipeline threatens the integrity of the whole tenant’s identity graph, not just a single application.

CVE-2026-50481 — Active Directory EoP (CVSS 9.9, CWE-471 Modification of Assumed-Immutable Data). An authorized attacker on the network can elevate privileges by tampering with data AD treats as immutable. Unlike the other three, this one is on-prem/hybrid: it applies to domain controllers reachable over the network, and MAID-class bugs in AD have historically been chainable into full domain compromise once an attacker can forge or alter values the directory assumes are trustworthy.

All four require the attacker to already hold some authorized/authenticated position — none is a fully unauthenticated, zero-click bug — but “authorized” in each case can mean a low-privilege service principal, a compromised standard user account, or a leaked token, which is a bar attackers clear constantly via phishing, credential stuffing, or a prior unrelated compromise. Given the CVSS 9.9 rating on all four, Microsoft and third-party scorers are treating “network-reachable, low attack complexity, no user interaction, full impact on confidentiality/integrity/availability” as the baseline once that initial authorization is obtained.

Exploitation status

There are no public reports of in-the-wild exploitation for any of the four as of this writing, and Microsoft has not flagged them as previously known or publicly disclosed prior to patching. That’s the good news — organizations have a window before proof-of-concept code circulates. It is not, however, a reason to delay: cloud-service-side bugs like the Service Bus and Entra Provisioning flaws are patched by Microsoft on the backend for the SaaS surface, but the Azure SRE Agent and on-prem Active Directory issues require action from customers, and AD elevation-of-privilege bugs in particular have a strong track record of getting reverse-engineered into working exploits within days of disclosure.

Mitigation

  • Active Directory (CVE-2026-50481): Apply the corresponding Windows Server security update to all domain controllers as soon as possible — treat this with the same urgency as a Patch Tuesday critical AD bug, since domain controller compromise is close to full-network compromise.
  • Azure SRE Agent (CVE-2026-62830): Review the agent’s assigned RBAC scope and confirm you’re on a patched build; audit recent SRE Agent action logs for remediation actions outside expected patterns.
  • Azure Service Bus / Entra Provisioning Service: These are cloud-side fixes Microsoft applies to the managed service, but rotate any Service Bus SAS tokens or connection strings you suspect may have been exposed, and review Entra provisioning sync logs for unexpected role or group membership changes in the affected window.
  • Cross-reference sign-in and directory audit logs for anomalous privilege changes tied to service principals or provisioning jobs around and after August 6.

Full advisory details are available through the Microsoft Security Response Center update guide for each CVE (CVE-2026-50515, CVE-2026-62830, CVE-2026-59115, CVE-2026-50481).