Privacy Trust

To comprehensively address CVE-2025-26629, Microsoft has released May 2025 security updates for all affected versions of Microsoft Office. Customers running any of these versions should ensure that they have the latest build installed. For more information and to verify the build version, see https://learn.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates. 

External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network. 

External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally. 

Server-Side Request Forgery (SSRF) in Microsoft Power Apps allows an unauthorized attacker to disclose information over a network 

Server-Side Request Forgery (SSRF) in Azure allows an authorized attacker to perform spoofing over a network. 

Improper Authorization in Azure Automation allows an authorized attacker to elevate privileges over a network. 

An elevation of privilege vulnerability exists when Visual Studio improperly handles pipeline job tokens. An attacker who successfully exploited this vulnerability could extend their access to a project. To exploit this vulnerability, an attacker would first have to have access to the project and swap the short-term token for a long-term one. The update addresses

Improper access control in Azure allows an unauthorized attacker to disclose information over a network. 

Improper verification of cryptographic signature in Microsoft Azure Functions allows an authorized attacker to execute code over a network. 

Improper authorization in Azure allows an authorized attacker to elevate privileges over a network.