On 3 September 2026, the National Vulnerability Database published two critical vulnerabilities in Microsoft’s cloud infrastructure, each scoring CVSS 10.0. CVE-2026-70352 affects Azure AI Language and allows unauthenticated privilege escalation. CVE-2026-83711 targets Azure Active Directory B2C with an authorisation bypass. A third flaw, CVE-2026-62916, scored CVSS 9.1 for an authentication bypass in Microsoft Entra ID. These vulnerabilities sit within the identity and authentication layers used by millions of UK small businesses relying on Microsoft 365 and Azure-based services. Separately, attackers are actively exploiting CVE-2026-32475, a critical file upload vulnerability in Elementor Pro, a WordPress plugin installed on approximately six million websites. The exploit allows remote code execution, leading to backdoor installation and site compromise. This episode provides specific remediation steps: verify Elementor Pro is updated to version 3.27.3 or later, enforce multi-factor authentication across all Microsoft 365 accounts, audit administrator privileges, and obtain written confirmation from managed service providers that cloud environments have been assessed. The episode emphasises that whilst Microsoft deploys cloud-side patches, businesses remain responsible for configuration verification and must understand their exposure to vendor infrastructure vulnerabilities.
