← Lark216 Home

Microsoft Update Intelligence

Administrator notices from Microsoft, summarised: what changed, and what you should do.

1Action Required 504Review Recommended
Microsoft Services 1
Product families
Microsoft 365
Clear
Advanced Filters
Review Recommended

Power Pages: Administration and governance - Configure site analytics and server logging

Admins can now configure site analytics and server logging for Power Pages sites, providing insights into traffic and user interactions.

What you should do

Review the setup process for enabling analytics and logging in Power Pages sites. AI-suggested

Other · m365-roadmap Original Microsoft announcement ↗
Details

Original Microsoft text

Gain insights into your Power Pages site with integrated telemetry and analytics. Use Application Insights to monitor page views, form interactions, session details, and client-side analytics. Detect server-side errors, performance issues, and access logs to resolve problems and optimize your site. To configure site analytics, makers must open the setup workspace and add the analytics provider script to enable traffic analytics. Business Value: You can monitor your Power Pages site traffic and user interactions with ease. Track page views, form interactions, and session details using client-si…

Type
M365 Roadmap
Tags
In development, General Availability, Preview, Worldwide (Standard Multi-Tenant), GCC, GCC High, DoD, Power Pages, Web
AI analysis
Low priority · generated by qwen2.5:7b · verify against the original
Review Recommended

Power Pages: Administration and governance - Manage external authentication providers with granular controls

Power Pages now allows administrators to manage external authentication providers with granular controls, enabling central enforcement and site-level exceptions.

What you should do

Review and configure the Power Platform admin center to manage external authentication providers for your Power Pages sites. AI-suggested

Other · m365-roadmap Original Microsoft announcement ↗
Details

Original Microsoft text

Power Pages now lets you manage external authentication providers with environment-level governance controls and optional site-level exceptions. You can centrally enforce which identity providers (IDPs) are allowed across all sites in an environment, while still enabling site-specific flexibility when needed. Makers will only see and select from the approved IDPs when setting up authentication, ensuring consistent governance and alignment with enterprise security policies. To enable this feature, go to the Power Platform admin center. Navigate to Manage > Power Pages > Governance settings > Au…

Type
M365 Roadmap
Services
Entra ID
Tags
In development, General Availability, Preview, Worldwide (Standard Multi-Tenant), GCC, GCC High, DoD, Power Pages, Web
AI analysis
Medium priority · generated by qwen2.5:7b · verify against the original
Review Recommended

Power Pages: Administration and governance - Enable self-service site ownership transfer

Power Pages now supports secure site ownership transfer, allowing existing site owners and global administrators to assign ownership to another valid user without manual intervention from support.

What you should do

Review the new ownership transfer process to ensure it aligns with your organization's governance standards and update relevant policies. AI-suggested

Other · m365-roadmap Original Microsoft announcement ↗
Details

Original Microsoft text

Power Pages now supports secure site ownership transfer for eligible sites. Existing site owners and global administrators can assign ownership to another valid user within the tenant without requiring manual intervention from support. The new owner must be a valid user with appropriate access to the environment. Every ownership transfer is recorded in an auditable history, including the previous owner, new owner, initiating user, and timestamp. Notifications are sent to the previous owner, the new owner, and administrators to ensure transparency and continuity and the changes get logged into …

Type
M365 Roadmap
Tags
Launched, General Availability, Preview, Worldwide (Standard Multi-Tenant), Power Pages, Web
AI analysis
Medium priority · generated by qwen2.5:7b · verify against the original
Review Recommended

CVE-2026-62840: Linux Kernel Elevation of Privilege Vulnerability

A critical security vulnerability in the Linux Kernel allows authorized attackers to elevate privileges locally. This affects systems running the affected kernel version.

What you should do

Update the Linux Kernel to the latest version to mitigate this vulnerability. AI-suggested

Details

Original Microsoft text

Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.

Severity
Critical
Type
Security updates
Tags
Linux Kernel, Elevation of Privilege, 2026-Oct
AI analysis
Critical priority · generated by qwen2.5:7b · verify against the original
Review Recommended

CVE-2026-96207: Microsoft Partner Center Elevation of Privilege Vulnerability

A critical security vulnerability in Microsoft Partner Center allows unauthorized attackers to elevate privileges due to improper certificate validation.

What you should do

Update Microsoft Partner Center to the latest version to address the vulnerability. AI-suggested

Details

Original Microsoft text

Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.

Severity
Critical · CVSS 10.0
Type
Security updates
Tags
Microsoft Partner Center, Elevation of Privilege, 2026-Oct
AI analysis
Critical priority · generated by qwen2.5:7b · verify against the original
Review Recommended

CVE-2026-94510: Microsoft Bookings Elevation of Privilege Vulnerability

A security vulnerability in Microsoft Bookings allows unauthorized attackers to elevate privileges, which could be exploited through user-controlled keys.

What you should do

Update Microsoft Bookings to the latest version to mitigate the vulnerability. AI-suggested

Details

Original Microsoft text

Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.

Severity
Critical · CVSS 9.9
Type
Security updates
Tags
Microsoft Bookings, Elevation of Privilege, 2026-Oct
AI analysis
Critical priority · generated by qwen2.5:7b · verify against the original
Review Recommended

CVE-2026-88131: Microsoft Dataverse Remote Code Execution Vulnerability

A critical security vulnerability in Microsoft Dataverse allows remote code execution; IT administrators must address this immediately to prevent unauthorized code execution over the network.

What you should do

Apply the security update as soon as possible to mitigate the risk of remote code execution. AI-suggested

Details

Original Microsoft text

Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network.

Severity
Critical · CVSS 9.8
Type
Security updates
Tags
Microsoft Dataverse, Remote Code Execution, 2026-Oct
AI analysis
Critical priority · generated by qwen2.5:7b · verify against the original
Review Recommended

CVE-2026-77903: Microsoft Dataverse Elevation of Privilege Vulnerability

A vulnerability in Microsoft Dataverse allows unauthorized attackers to bypass authentication and elevate privileges, posing a critical security risk.

What you should do

Apply the security update as soon as possible to mitigate the vulnerability. AI-suggested

Details

Original Microsoft text

Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network.

Severity
Critical · CVSS 9.0
Type
Security updates
Tags
Microsoft Dataverse, Elevation of Privilege, 2026-Sep
AI analysis
Critical priority · generated by qwen2.5:7b · verify against the original
Review Recommended

CVE-2026-69843: Microsoft Fabric Elevation of Privilege Vulnerability

A vulnerability in Microsoft Fabric allows unauthorized attackers to bypass authentication and elevate privileges, posing a critical security risk.

What you should do

Apply the security update as soon as possible to mitigate the risk of unauthorized access and privilege elevation. AI-suggested

Details

Original Microsoft text

Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network.

Severity
Critical · CVSS 10.0
Type
Security updates
Tags
Microsoft Fabric, Elevation of Privilege, 2026-Sep
AI analysis
Critical priority · generated by qwen2.5:7b · possibly affects Other · verify against the original
Review Recommended

CVE-2026-73016: DirectWrite Remote Code Execution Vulnerability

A security vulnerability in the Microsoft Graphics Component allows remote code execution via a heap-based buffer overflow.

What you should do

Apply the latest security update for the Microsoft Graphics Component immediately. AI-suggested

Details

Original Microsoft text

Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

Type
Security updates
Tags
Microsoft Graphics Component, 2026-Sep
AI analysis
High priority · generated by qwen2.5:7b · verify against the original
Review Recommended

CVE-2026-70351: Microsoft WebP Image Extension Remote Code Execution Vulnerability

A critical security vulnerability in the Microsoft WebP Image Extension allows remote code execution, which could be exploited by unauthorized attackers.

What you should do

Update affected systems to the latest version to mitigate the vulnerability. AI-suggested

Details

Original Microsoft text

Integer overflow or wraparound in Microsoft WebP Image Extension allows an unauthorized attacker to execute code over a network.

Severity
Critical · CVSS 8.8
Type
Security updates
Tags
Microsoft WebP Image Extension, Remote Code Execution, 2026-Sep
AI analysis
Critical priority · generated by qwen2.5:7b · verify against the original
Review Recommended

CVE-2026-70178: Microsoft Fabric Elevation of Privilege Vulnerability

A vulnerability in Microsoft Fabric allows authorized attackers to elevate privileges, which could lead to a security breach.

What you should do

Apply the security update as soon as possible to mitigate the vulnerability. AI-suggested

Details

Original Microsoft text

Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.

Severity
Critical · CVSS 8.5
Type
Security updates
Tags
Microsoft Fabric, Elevation of Privilege, 2026-Sep
AI analysis
Critical priority · generated by qwen2.5:7b · verify against the original
Review Recommended

CVE-2026-66302: Skype for Business Remote Code Execution Vulnerability

A remote code execution vulnerability in Skype for Business allows unauthorized attackers to execute code over a network by controlling file names or paths.

What you should do

Update Skype for Business to the latest version to mitigate the vulnerability. AI-suggested

Details

Original Microsoft text

External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.

Type
Security updates
Tags
Skype for Business, 2026-Sep
AI analysis
High priority · generated by qwen2.5:7b · verify against the original
Review Recommended

CVE-2026-62906: Microsoft Discovery Studio Information Disclosure Vulnerability

A critical security vulnerability in Microsoft Discovery Studio could allow unauthorized attackers to disclose information over a network. This affects users of Microsoft Discovery Studio.

What you should do

Apply the security update for Microsoft Discovery Studio as soon as possible to mitigate the risk of information disclosure. AI-suggested

Details

Original Microsoft text

Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network.

Severity
Critical · CVSS 7.4
Type
Security updates
Tags
Microsoft Discovery Studio, Information Disclosure, 2026-Sep
AI analysis
Critical priority · generated by qwen2.5:7b · verify against the original
Review Recommended

CVE-2026-69558: Microsoft Partner Center Information Disclosure Vulnerability

A security vulnerability in Microsoft Partner Center allows unauthorized attackers to disclose information through a user-controlled key.

What you should do

Update Microsoft Partner Center to the latest version to mitigate the vulnerability. AI-suggested

Details

Original Microsoft text

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network.

Severity
Critical · CVSS 8.6
Type
Security updates
Tags
Microsoft Partner Center, Information Disclosure, 2026-Aug
AI analysis
Critical priority · generated by qwen2.5:7b · verify against the original
Review Recommended

CVE-2026-63509: Microsoft Fabric Elevation of Privilege Vulnerability

A vulnerability in Microsoft Fabric allows authorized attackers to elevate privileges over a network, classified as a critical security issue.

What you should do

Apply the security update as soon as possible to mitigate the vulnerability. AI-suggested

Details

Original Microsoft text

Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.

Severity
Critical · CVSS 9.9
Type
Security updates
Tags
Microsoft Fabric, Elevation of Privilege, 2026-Aug
AI analysis
Critical priority · generated by qwen2.5:7b · verify against the original