Microsoft released patches for 18 vulnerabilities on Thursday, spanning its Azure cloud portfolio and Copilot-branded AI products. Elevation of privilege flaws made up the bulk of the disclosures, affecting Azure ARC, Azure AI Foundry, Azure Logic Apps, Azure Billing, Azure HorizonDB, Azure Cosmos DB, Azure Container Registry, Microsoft Fabric, Microsoft Dataverse, and Microsoft 365 Copilot. Several information disclosure vulnerabilities were addressed in Copilot, Microsoft 365 Copilot, Microsoft 365 Copilot Business Chat, and Azure Machine Learning. A single spoofing vulnerability was patched in Azure Portal. Microsoft rated all vulnerabilities as critical, but their CVSS scores indicate high or medium severity for some. While some flaws were discovered internally by Microsoft, many were reported by external researchers. None have been flagged as exploited, and Microsoft noted all fixes were implemented on the server side, meaning customers do not need to take any action. Microsoft also announced patches this week for a privilege escalation vulnerability affecting Windows. Users do need to update Windows to resolve this flaw, tracked as CVE-2026-85921, but Microsoft believes exploitation is ‘less likely’. Microsoft fixed a record-breaking 970 vulnerabilities across its products with the latest Patch Tuesday updates.