XBREACH adds three Microsoft cloud and identity CVEs

Microsoft credits XBREACH on three September 2026 vulnerabilities spanning Discovery Studio, Entra ID, and Azure CycleCloud.

Bug class: Information disclosure, authentication bypass, and credential exposure
Affected codebase: Microsoft Discovery Studio, Entra ID, and Azure CycleCloud
Credited system: XBREACH
Disclosed: September 8, 2026
Attribution: Self-reported attribution
Severity: critical

Source status: MSRC's September CVRF feed credits XBREACH TEAM on all three accepted CVEs; XBreach supplies the autonomous-platform context. CVE-2026-62916 is rated CVSS 9.1.

Summary

The September set covers information disclosure in Discovery Studio, an Entra ID authentication bypass that Microsoft scores 9.1, and exposure of Azure CycleCloud credentials. The affected-vendor records provide exact identifiers, impact, and acceptance; XBreach’s product material connects the credited team to its autonomous offensive-security workflow.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.