Three CVSS 10.0. One patch day. July 24, 2026.

Microsoft’s Trusted Security Incident Response Event (mstie) posted six critical CVEs that day. Three scored a perfect 10.0:

  • CVE-2026-56191 — Exchange Online (CVSS 10.0, unauthenticated)
  • CVE-2026-58275 — Azure DNS (CVSS 10.0, unauthenticated)
  • CVE-2026-62825 — Azure Key Vault (CVSS 10.0, unauthenticated)

All three from secure@microsoft.com. All three with the same vector structure: AV:N/AC:L/PR:N/UI:N/S:C/C:*/I:H/A:H.

The ones below the 10.0 are notable too — Azure AI Search SSRF (8.5), M365 Copilot deserialization (9.9), Microsoft Account heap overflow (9.8). But the three 10.0s are the ones that matter right now, because they share a pattern.

The Pattern: Auth Failures at the Identity Boundary

All three 10.0 CVEs are fundamentally authentication failures. Not crypto bugs. Not buffer overflows. The identity layer accepts a request that should have been rejected.

Exchange Online (CVE-2026-56191): “Improper authentication — allows an unauthenticated attacker to perform tampering over a network.” Vector includes S:C (scope changed), meaning the attacker can reach resources outside their tenant or service boundary. The impact is total: confidentiality, integrity, availability.

Azure DNS (CVE-2026-58275): “Missing authorization — allows an unauthenticated attacker to elevate privileges over a network.” Scope changed, high integrity and availability impact. An attacker can modify DNS records (integrity) or delete zones (availability) without any credentials.

Azure Key Vault (CVE-2026-62825): “Improper authentication — allows an unauthenticated attacker to elevate privileges over a network.” Scope changed, high integrity impact, no confidentiality impact. Someone can change key material without knowing the key.

The common thread:

  1. Network-accessible (AV:N) — no physical or local access needed
  2. Low complexity (AC:L) — no specific conditions or chaining required
  3. No privileges (PR:N) — no auth needed at all
  4. No user interaction (UI:N) — automated exploitation
  5. Scope changed (S:C) — the attacker can affect resources outside the immediate service

This last point — S:C — is what makes scope-changed 10.0s different from scope-unchanged 10.0s. A scope-unchanged 10.0 means “total impact within this service.” A scope-changed 10.0 means “total impact, and you can reach other services or tenants from here.”

In practice, that means:

  • Exchange Online: probably can reach other Microsoft 365 services
  • Azure DNS: can reach other Azure resources via DNS resolution or cross-service references
  • Key Vault: can reach other services that use the same identity or key material

What the Patch Day Also Hid

Two more CVSS 9.0+ from the same day:

  • CVE-2026-50517 (9.9) — M365 Copilot deserialization (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Low-priv auth, scope changed, total impact. Same pattern as the 10.0s but requires low-level authentication first.
  • CVE-2026-56167 (8.5) — Azure AI Search SSRF (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N). Low-priv auth, scope changed, SSRF. This is the web/API primitive one — if you’re doing bug bounty on Azure AI Search, this is a verified SSRF-to-priv-esc.

And one worth watching for active exploitation:

  • CVE-2026-56165 (9.8) — Microsoft Account heap-based buffer overflow (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Unauthenticated, network, low complexity, total impact. exploitation: yes per CISA SSVC. This is the kind of 9.8 that gets written into exploit kits within days.

What Practitioners Should Do

Tier 1 — Today:

  1. Check Exchange Online exposure. If you’re on Exchange Online (not self-hosted), you’re patched automatically on the next rollup. If self-hosted, patch immediately.
  2. Verify Azure DNS zones have no public-facing management endpoints that are unauthenticated. The fix should require auth on management operations.
  3. Audit Key Vault access policies for unauthenticated operations. Specifically look at get, list, update, and delete on keys, secrets, and certificates.

Tier 2 — This week: 4. Check Azure AI Search for SSRF-prone configurations — services with url parameters that accept external values. 5. Review M365 Copilot integrations for deserialization endpoints. 6. Flag Microsoft Account as potentially exploitable (9.8, unauthenticated RCE, CISA marked exploitation: yes).

Tier 3 — Ongoing: 7. The S:C signal is worth paying attention to. Scope-changed vulnerabilities tend to have wider blast radius than their CVSS alone suggests. If your architecture has tight inter-service dependencies (shared identity, cross-service data flows), a scope-changed 10.0 can cascade.

Why Three 10.0s in One Batch Matters

Most patch days have one or two criticals. Three at once — all scope-changed, all unauthenticated, all auth-related — suggests a coordinated review found a common root cause: the identity layer across these services has a systematic issue where certain request paths bypass authentication.

This is the pattern you want to look for on your own assets: services where the public API accepts requests that reach internal state, but the auth check happens on a different code path. The request gets through the public endpoint, hits the internal handler, and only then gets rejected — or gets accepted if the handler doesn’t check.

If you’re running Azure or M365, patch now. If you’re auditing Azure attack surfaces, these three are the highest-value starting points this week.

Further Reading