CVE-2026-69865 & CVE-2026-69843: Microsoft Cloud Auth Bypasses (CVSS 10) — Detection and Remediation Guide | Security Arsenal

NVD published four CRITICAL, network-exploitable CVEs in the last 72 hours, and three of them sit squarely in Microsoft's cloud control plane. The headline item, CVE-2026-69865 (CVSS 10.0), is an authorization bypass through a user-controlled key in Microsoft Container Registry that allows an unauthorized attacker to elevate privileges over the network. Alongside it, CVE-2026-69843 (CVSS 10.0) is an authentication bypass by spoofing in Microsoft Fabric, and CVE-2026-77903 (CVSS 9.0) is a spoofing-based authentication bypass in Microsoft Dataverse. A fourth entry, CVE-2024-58385 (CVSS 9.8), documents an unauthenticated SQL injection in Yonyou U8 CRM's fillbacksettingedit.php.

Let me be blunt about why this matters: two of these are perfect-score, remotely exploitable privilege escalation flaws in services that sit at the heart of enterprise identity, analytics, and software supply chains. A compromised container registry is not a single breached host — it is a poisoned distribution channel for every workload that pulls from it. If you run ACR, Fabric, or Dataverse, this week is a credential-rotation and audit-log-review week, full stop.

Technical Analysis

CVE-2026-69865 — Microsoft Container Registry Authorization Bypass (CVSS 10.0)

This is a CWE-639 class flaw: authorization bypass through a user-controlled key. In practical terms, the registry's authorization layer trusts an attacker-supplied key or object identifier when resolving which resource or scope a request applies to. Because the check is keyed off something the caller controls — rather than a server-side binding between identity and resource — a remote, unauthenticated attacker can reference resources outside their authority and escalate privileges over the network.

From a defender's perspective, the blast radius is severe:

Supply-chain poisoning: unauthorized push/overwrite of container images consumed by AKS, Azure Container Apps, or CI/CD pipelines.
Credential and secret exposure: registries frequently hold images embedding connection strings, certificates, or internal service endpoints.
Persistence via registry artifacts: tampered scope maps, tokens, or webhook configurations survive password resets if not audited.

Exploitation requirements are minimal — network access to the registry endpoint, no prior authentication. That combination (AV:N, no privileges, no user interaction) is exactly what earns a 10.0.

CVE-2026-69843 — Microsoft Fabric Authentication Bypass by Spoofing (CVSS 10.0)

Fabric aggregates Power BI, lakehouses, warehouses, and data pipelines under one identity plane. A spoofing-based authentication bypass here means an attacker can present as a legitimate identity and elevate privileges across the analytics estate. Realistic outcomes: exfiltration of lakehouse and warehouse data, tampering with semantic models feeding executive reporting, and abuse of pipeline identities to pivot into connected data sources.

CVE-2026-77903 — Microsoft Dataverse Authentication Bypass by Spoofing (CVSS 9.0)

Same spoofing class, slightly lower score, but Dataverse underpins Dynamics 365 and the Power Platform. Compromise here means business-application data — customer records, financials, field-service operations — exposed under a spoofed identity, plus abuse of application users and service principals registered against Dataverse environments.

CVE-2024-58385 — Yonyou U8 CRM Unauthenticated SQL Injection (CVSS 9.8)

An older flaw newly published by NVD this cycle: unauthenticated SQL injection in fillbacksettingedit.php. We include it because it surfaced in the same publication batch — and unauthenticated SQLi in an ERP/CRM platform is the kind of bug that gets weaponized fast once NVD indexing draws attention. If you operate Yonyou U8 (common in APAC supply chains), treat this as patch-now and put WAF coverage in front of the affected endpoint in the interim.

Exploitation Status

At time of publication, we have no confirmed in-the-wild exploitation of CVE-2026-69865, CVE-2026-69843, or CVE-2026-77903, and none appear on the CISA Known Exploited Vulnerabilities catalog yet. That is a window, not a comfort. CVSS 10 auth bypasses in Microsoft cloud services historically attract proof-of-concept development within days of disclosure, and the details now indexed in NVD give researchers everything they need to start. Operate as if exploitation begins this week.

Detection & Response

These are Microsoft-hosted services, so the platform-side fix is applied server-side by Microsoft — which means your defensive leverage is telemetry, identity hygiene, and artifact integrity. The detections below focus on the management-plane operations and authentication anomalies an attacker abusing these flaws would generate.

Sigma Rules

The first rule fires on ACR management-plane operations consistent with post-exploitation activity — credential regeneration, token creation, and scope-map modification are exactly what an attacker needs to persist after abusing CVE-2026-69865. The second targets the spoofing class in Fabric/Dataverse by surfacing successful sign-ins to those applications that bypassed Conditional Access enforcement.

YAML

---
title: Azure Container Registry Credential or Token Manipulation
id: 3f8a2c71-6b4d-4e9a-b2c5-8d1f0a7e5c39
status: experimental
description: Detects management-plane operations that regenerate ACR credentials or modify registry tokens and scope maps, consistent with persistence activity following abuse of CVE-2026-69865 authorization bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-69865
  - https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/06/08
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1098
logsource:
  product: azure
  category: activitylogs
detection:
  selection:
    operationName|contains:
      - 'MICROSOFT.CONTAINERREGISTRY/REGISTRIES/REGENERATECREDENTIAL'
      - 'MICROSOFT.CONTAINERREGISTRY/REGISTRIES/TOKENS/WRITE'
      - 'MICROSOFT.CONTAINERREGISTRY/REGISTRIES/SCOPEMAPS/WRITE'
  condition: selection
falsepositives:
  - Legitimate registry administration and infrastructure-as-code deployments
level: high
---
title: Anomalous Unconditional Authentication to Microsoft Fabric or Dataverse
id: 9c4e7b12-2d8f-4a65-9e31-5f6c0b3d8a47
status: experimental
description: Detects successful sign-ins to Microsoft Fabric, Power BI, or Dataverse applications where Conditional Access was not applied or failed, consistent with spoofing-based authentication bypass attempts (CVE-2026-69843, CVE-2026-77903).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-69843
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/06/08
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  product: azure
  category: signinlogs
detection:
  selection:
    AppDisplayName|contains:
      - 'Power BI'
      - 'Microsoft Fabric'
      - 'Common Data Service'
      - 'Dynamics 365'
    ResultType: 0
  filter_ca:
    ConditionalAccessStatus:
      - 'notApplied'
      - 'failure'
  condition: selection and filter_ca
falsepositives:
  - Service principals and legacy integrations exempt from Conditional Access policies
level: medium

Microsoft Sentinel / Defender KQL

Two hunts: the first surfaces ACR control-plane operations that attackers need for persistence; the second baselines sign-in behavior to Fabric and Dataverse apps and flags identities authenticating from an anomalous number of IPs or locations — the classic footprint of token replay or spoofed-session abuse.

KQL — Microsoft Sentinel / Defender

// Hunt 1: ACR management-plane operations consistent with CVE-2026-69865 post-exploitation
AzureActivity
| where TimeGenerated > ago(7d)
| where OperationNameValue has "MICROSOFT.CONTAINERREGISTRY"
| where OperationNameValue has_any ("REGENERATECREDENTIAL", "TOKENS/WRITE", "SCOPEMAPS/WRITE", "IMPORTIMAGE")
| project TimeGenerated, OperationNameValue, Caller, CallerIpAddress, ActivityStatusValue, ResourceGroup, _ResourceId
| sort by TimeGenerated desc

// Hunt 2: Anomalous sign-in dispersion to Fabric / Dataverse applications
SigninLogs
| where TimeGenerated > ago(7d)
| where AppDisplayName has_any ("Power BI", "Fabric", "Common Data Service", "Dataverse", "Dynamics")
| where ResultType == 0
| summarize SignIns = count(), DistinctIPs = dcount(IPAddress), IPs = make_set(IPAddress), Locations = make_set(Location) by UserPrincipalName, AppDisplayName, bin(TimeGenerated, 1d)
| where DistinctIPs > 3
| sort by DistinctIPs desc

Tune the DistinctIPs > 3 threshold against your own baseline — mobile-heavy Power BI users will drift higher. The goal is spotting identities whose geography or IP diversity changed abruptly around the disclosure window, not flagging road warriors.

Velociraptor VQL

If CVE-2026-69865 abuse leads to stolen or misused registry credentials, the follow-on activity lands on endpoints: engineers' machines or build agents running az acr login, docker login against *.azurecr.io, or processes touching the Azure token cache. This hunt surfaces exactly that.

VQL — Velociraptor

-- Hunt for endpoint artifacts indicating theft or misuse of Azure/ACR credentials
-- (registry authentication, Azure token cache access) following CVE-2026-69865 disclosure
SELECT Pid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(azurecr\\.io|az acr login|docker login|accesstokens\\.json|msal_token_cache)'

Validate hits against your known build agents and developer workstations. Anything matching outside that allowlist — especially on servers that have no business pulling images — warrants immediate credential revocation for the associated identity.

Verification & Hardening Script

Run this against every subscription to establish your ACR exposure posture. The admin user is a shared account that bypasses per-identity authorization — exactly the kind of key-controlled auth path implicated by CVE-2026-69865 — and it should be disabled everywhere.

PowerShell

# CVE-2026-69865 / CVE-2026-69843 / CVE-2026-77903 — Verification & Hardening
# Requires: Az PowerShell module; run with Owner/Contributor context per subscription

# 1. Audit every Azure Container Registry: admin user status + public exposure
Get-AzSubscription | ForEach-Object {
    $sub = $_.Name
    Set-AzContext -SubscriptionId $_.Id | Out-Null
    Get-AzContainerRegistry | ForEach-Object {
        [PSCustomObject]@{
            Subscription        = $sub
            Registry            = $_.Name
            ResourceGroup       = $_.ResourceGroupName
            AdminUserEnabled    = $_.AdminUserEnabled
            PublicNetworkAccess = $_.PublicNetworkAccess
        }
    }
} | Format-Table -AutoSize

# 2. Disable the ACR admin user (shared credential bypasses per-identity authorization)
# Update-AzContainerRegistry -ResourceGroupName "<rg>" -Name "<acr>" -DisableAdminUser

# 3. Rotate credentials on any registry where the admin user was ever enabled
# New-AzContainerRegistryCredential -ResourceGroupName "<rg>" -Name "<acr>" -PasswordName Password

# 4. Review data-plane role assignments for over-privileged registry access
Get-AzRoleAssignment |
    Where-Object { $_.RoleDefinitionName -match 'AcrPull|AcrPush|AcrDelete|AcrImageSigner' } |
    Select-Object DisplayName, SignInName, RoleDefinitionName, Scope |
    Sort-Object Scope

Any registry returning AdminUserEnabled = True or PublicNetworkAccess = Enabled without a documented business justification is a finding to remediate today, not next sprint.

Remediation

1. Confirm Microsoft's server-side remediation. For hosted services (Fabric, Dataverse, and the ACR control plane), Microsoft applies fixes server-side. Verify remediation status against the MSRC Security Update Guide entries for each CVE and your Azure Service Health dashboard:

Do not assume silence means you are patched — check the advisory status explicitly and open a support case if your tenant shows pre-fix behavior.

2. Rotate and audit ACR credentials — assume exposure. Regenerate admin passwords (or better, disable the admin user entirely), revoke and reissue all registry tokens, audit scope maps for unexpected entries, and review webhook configurations. Switch data-plane auth to Microsoft Entra identities with least-privilege AcrPull/AcrPush assignments.

3. Verify image integrity. Because the worst-case outcome of a registry auth bypass is image tampering, audit pull/push history for unexpected image digests or tags during the exposure window, and enforce image signing/verification (e.g., notation/OCI signing) in your deployment pipelines before you trust existing tags again.

4. Harden Fabric and Dataverse identity controls. Enforce Conditional Access with MFA and compliant-device requirements for all Fabric/Power BI and Dynamics 365/Dataverse applications — the detections above will tell you which identities currently bypass CA. Review service principals and application users registered against Dataverse environments, trim security roles to least privilege, and enable unified audit logging (Purview) if not already streaming to your SIEM.

5. Reduce network exposure. Disable public network access on registries where private endpoints are feasible, and restrict Fabric/Dataverse access via CA named locations where business requirements allow.

6. Yonyou U8 CRM (CVE-2024-58385). If this product exists anywhere in your estate — check APAC subsidiaries and acquired entities — apply vendor patches immediately and place WAF rules blocking unauthenticated requests to fillbacksettingedit.php until confirmed patched.

7. Monitor KEV. None of these CVEs are on CISA KEV as of publication. Given the CVSS 10 scores and network-vector exploitation, expect that to change if PoCs surface — set a standing watch and treat KEV addition as an escalation trigger for emergency change windows.

The pattern across this disclosure batch is worth internalizing: authorization and authentication flaws in cloud control planes are becoming the highest-leverage targets in the Microsoft ecosystem. Patching is Microsoft's job here; identity hygiene, credential rotation, and management-plane telemetry are yours.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub

CVE-2026-69865 & CVE-2026-69843: Microsoft Cloud Auth Bypasses (CVSS 10) — Detection and Remediation Guide