Six Microsoft cloud flaws scored 10.0 including CVE-2026-62825 need no customer action

On July 23, 2026, Microsoft published information on 51 security flaws at once. Six of them carry a severity rating of 10.0 — the maximum possible score. Azure Key Vault, Azure DNS, Exchange Online. If you run any of those, the names alone are enough to make you stop what you are doing.

And yet, for those six, there is nothing for you to do. No update exists to install. Microsoft says so directly in its own advisory: "This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take."

Meanwhile, one flaw published the same day with a severity of 3.1 does require you to install an update. On this particular day, the size of the number and the amount of work on your plate run in exactly opposite directions. This article breaks down how those 51 flaws actually split, based on a one-by-one review of Microsoft's published data.

The 51 flaws published on July 23 fall into two groups

Microsoft publishes vulnerability information through its Security Update Guide, and each entry carries a field called customerActionRequired. Sorting the 51 entries from July 23 by that field gives the following picture.

Every 10.0 sits in the top row. All 14 entries in that row need no action from you, while the 37 entries in the two lower rows — the ones with the smallest numbers — are the ones that require work. The severity scores and your workload are lined up in opposite order on this day.

The reason is straightforward. Flaws in cloud services are fixed on Microsoft's own servers. There is no software on your side to patch. Azure Linux (the Linux distribution Microsoft ships for its own cloud, previously called Mariner) and Edge, on the other hand, run on your servers and your machines, so they stay broken until you update them.

What each of the six 10.0 flaws actually does

Here are the six entries scored at the maximum. For all of them, Microsoft reports no observed exploitation and no prior public disclosure, and all fixes are complete.

CVE-2026-62825: Azure Key Vault failed to verify identity properly

Azure Key Vault is where you store the strings you can never afford to leak — passwords, API keys, encryption keys. It contained an improper authentication flaw (CWE-287), meaning it proceeded without correctly confirming who was on the other end. Microsoft describes it as allowing "an unauthorized attacker to elevate privileges over a network." This is the best-known service of the six, and English-language coverage focused heavily on it.

CVE-2026-56163: Azure Kubernetes Service left a critical function unauthenticated

Azure Kubernetes Service (AKS) runs large numbers of containerized applications. A critical function was reachable without authentication (CWE-306), opening a path to privilege escalation.

CVE-2026-58275: Azure DNS skipped an authorization check

Azure DNS maps domain names to server addresses. The check for whether a given party was permitted to perform an operation was missing (CWE-862). DNS decides where traffic enters, so control over it creates room to redirect users to a server that is not the intended one.

CVE-2026-58630: Azure App Service — but only the Azure Stack Hub edition

This one is different from the rest. Microsoft's official title is "Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability." Azure Stack Hub is the product that puts Azure's machinery inside your own data center, so it is not purely a cloud service. Microsoft still classifies this entry as requiring no customer action. The summary in the US National Vulnerability Database only says "Azure App Service" and drops the Stack Hub qualifier entirely. Read the database summary alone and ordinary Azure App Service looks affected, which it is not.

CVE-2026-56191: Exchange Online authentication flaw enabling tampering

An improper authentication flaw in the Microsoft 365 mail service. The impact type is classified as Tampering, separate from privilege escalation or information disclosure. Of the six, this is the name most likely to describe something your own organization runs. Even so, there is no update on your side to apply.

CVE-2026-57106: Data Quality privilege escalation

A privilege escalation flaw in a data quality service. It is the least recognizable of the six, and Microsoft's entry carries only the product tag "Data Quality" without detailed configuration information.

The other eight cloud entries are also marked "no action"

The cloud group totals 14 entries for the day. The remaining eight are likewise classified as requiring nothing from customers.

The entry that stands out here is Microsoft Surface (CVE-2026-54120). Surface is a PC that Microsoft sells, so an update on the device itself would seem natural. Microsoft nonetheless classifies it as requiring no action, which reads as the flaw having been handled on the service side rather than on the hardware.

Note also that Microsoft Graph is scored 6.5 yet carries the same "Critical" severity label as the other 13. The cloud entries appear to receive that label uniformly, which means sorting your work by the severity label alone will mislead you.

The kind of attacker who would want these six

Nobody spraying mass phishing goes after the foundations of a cloud platform. The relevant attacker is the kind who studies a cloud provider's own services looking for a route across the boundary into someone else's tenant. Build that route once and it reaches every company sitting on the platform. Expensive work, but the arithmetic pays off.

Against a shared cloud platform, the move is to exploit the gaps in identity and permission checks to reach into territory that should be closed to them. Key Vault means the passwords and keys deposited there. Azure DNS means the settings that point traffic at a different server. Exchange Online means message contents and delivery records.

Individuals using the service would lose data without having made any mistake of their own, and companies would find the leak coming from the shared layer they entrusted to someone else rather than from servers they control. In this case, though, Microsoft states there is no observed exploitation and the fixes are complete. This is not a warning about something coming. It is a report that something was closed before it arrived.

If no action is needed, why issue a CVE at all?

A fair question: if customers do nothing, why publish? This is the result of a policy Microsoft adopted in 2024. The company decided to issue CVE identifiers for cloud service vulnerabilities as well, publishing them even when no customer-side work follows. The FAQ on these entries states the purpose plainly.

So these 14 entries are not "this is dangerous, please fix it" notices. They are after-the-fact reports saying "this flaw existed and we fixed it." Good news for customers, but in vulnerability databases they line up in exactly the same shape as everything else, which leaves the number 10.0 free to travel on its own.

Coverage and the official record do not match

Several English-language outlets covered the Azure Key Vault entry (CVE-2026-62825) on its own, urging readers to review vault access permissions and prepare to rotate their secrets. Given a 10.0 attached to a service that holds keys, the instinct is understandable.

But Microsoft itself asks for none of that. The published customerActionRequired value is false, and the FAQ is a single sentence saying there is no action to take. Exploitation is marked "No," prior public disclosure "No." Rotating keys is sound practice on its own merits, but it has not been presented officially as an urgent step justified by this vulnerability.

This article grounds its judgement in Microsoft's published data. If confirmed exploitation or further advisories appear, we will update this page.

The 37 entries that actually require work

The same July 23 batch also carried 37 entries that do need updates. Less headline-friendly, but this is where the work is.

Azure Linux (Mariner): 25 entries

Severities run from 3.1 to 7.5, with nothing dramatic. Azure Linux frequently runs underneath AKS nodes and container platforms on Azure, which means you may be running it without ever having chosen it. Package updates address these. The lowest, CVE-2026-55708, is scored 3.1 and is still classified as requiring customer action.

Microsoft Edge: 12 entries (CVE-2026-16413 through 16424)

Edge is built on Chromium, the same foundation as Chrome, so fixes made upstream arrive as Edge updates. These 12 are that intake. Edge updates itself by default, so in most environments this happens on its own, but anywhere auto-update is disabled needs attention.

The following day, July 24, Microsoft added three Edge-specific flaws (CVE-2026-57989, 57990 and 57978). Two are scored 7.4 and require a specific sequence: visiting an attacker-controlled page and then performing two tap gestures that trigger autofill, after which information can be read. The fixed build is Edge 150.0.4078.99, released July 24 and based on Chromium 150.0.7871.187. On July 25, four more Chrome-side flaws (CVE-2026-16804 through 16807) were taken into Edge as well. Browser-side history is collected in our Chrome and Edge V8 zero-day roundup.

Does this affect you? A quick reference

To check your Edge version, open Edge, click "…" at the top right, then "Help and feedback" → "About Microsoft Edge." Opening that screen triggers an update check on its own.

Note that the July 14 Patch Tuesday release is a separate matter and does contain items requiring real work, including an unauthenticated takeover in SharePoint Server. Those are covered in our July 2026 Microsoft monthly update roundup.

Frequently asked questions

Is it really true that a 10.0 needs no response?

According to Microsoft's published data, yes. A CVSS severity score measures how bad the outcome would be if the flaw were exploited. It does not measure what you should do. These six were published in an already-fixed state, before any exploitation occurred.

Should I rotate my passwords and API keys?

Microsoft has not asked for rotation on the basis of these entries, and exploitation is marked as not observed. Periodic rotation is good hygiene in general, but no official instruction exists to treat it as an emergency step here.

Are any of these in the US government's exploited-vulnerabilities list?

As of July 29, 2026, none of the 14 entries appear in CISA's Known Exploited Vulnerabilities catalog. Microsoft's own assessment also records no exploitation.

Have Japanese authorities issued advisories?

As of July 29, 2026, no individual advisories covering these 14 entries have been found from JVN, JPCERT/CC or IPA. Because no customer-side work is involved, this class of disclosure rarely triggers a national advisory.

I use Azure App Service. Am I at risk?

CVE-2026-58630 applies to "Azure App Service on Azure Stack Hub" in Microsoft's official title. That is the edition installed in your own data center, and it is a different product from App Service running on Azure. The database summary drops the qualifier, which makes the summary alone easy to misread.

Summary

Of the 51 entries Microsoft published on July 23, 2026, the 14 cloud entries — including all six scored 10.0 — are already fixed and require nothing from customers. The work sits with the 25 Azure Linux entries scored between 3.1 and 7.5, and the 12 Microsoft Edge entries plus the Edge releases that followed.

A severity score is not a task list. Now that Microsoft issues CVE identifiers for cloud flaws too, this kind of "10.0 you only need to read" will keep arriving on a regular basis. Before reacting to the number, check whether an update exists to install at all. For this batch, that single question settles it.

References

• ・Microsoft Security Response Center — CVE-2026-62825 Azure Key Vault Elevation of Privilege Vulnerability
• ・MSRC — CVE-2026-56163 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
• ・MSRC — CVE-2026-56191 Microsoft Exchange Online Tampering Vulnerability
• ・MSRC — CVE-2026-58275 Azure DNS Elevation of Privilege Vulnerability
• ・MSRC — CVE-2026-58630 Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
• ・MSRC — CVE-2026-57106 Data Quality Elevation of Privilege Vulnerability
• ・MSRC — CVE-2026-57989 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
• ・Microsoft — July 2026 Security Updates release notes
• ・Microsoft — Toward greater transparency: Unveiling Cloud Service CVEs
• ・NVD — CVE-2026-62825
• ・CWE-287: Improper Authentication
• ・GitHub — microsoft/azurelinux (formerly CBL-Mariner)