Out of 415 vulnerabilities patched, 62 of which were critical, Azure SRE agent is rated 9.9 and Copilot Cowork 9.3. Both are due to a faulty authorization control.
The August 2026 Patch Tuesday fixes 415 vulnerabilities at Microsoft, 62 of which are classified as critical. Two of them directly concern the publisher's agentic products, and for the same basic reason: an authorization control that does not do its job.
CVE-2026-62830 targets Azure SRE Agent, the AI-driven reliability engineering service, and peaks at 9.9 on the CVSS scale. Missing authorization allows a low-privileged remote attacker to elevate their rights on the network, without any user interaction. CVE-2026-59118 hits Copilot Cowork and reaches 9.3: Insufficient authorization control opens elevation of privilege to an unauthenticated attacker, with low attack complexity.
Only one flaw is confirmed to be exploited in the wild, CVE-2026-68820, rated 7.0, which affects the Ancillary Function Driver for WinSock. The convergence of the two most serious vulnerabilities of the lot on agentic components says enough about where the attack surface is moving: these services act on the infrastructure with extended rights, which turns an authorization error into a takeover.
Read the full article on the original source
Go to the source →