Microsoft Security Updates – 24 May 2026

The addressed vulnerabilities could allow the attacker to obtain sensitive information, gain elevated privileges, execute arbitrary code, and gain access to the affected systems.

Sample of the addressed vulnerabilities:

1. Microsoft Power Pages Remote Code Execution Vulnerability (CVE-2026- 23652):

• CVSS: 10.0
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Remote Code Execution

2. Microsoft Entra ID Elevation of Privilege Vulnerability (CVE-2026-42901):

• CVSS: 10.0
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Gain Privileges

Sample of the affected products:

• Microsoft Power Pages.
• Microsoft Global Secure Access (GSA).
• Microsoft Planetary Computer Pro (GeoCatalog).
• Microsoft Entra ID.
• Azure Privileged Identity Management (PIM).
• Azure Resource Manager.