Vulnerability Spotlight: Remote code execution, privilege escalation bugs in Microsoft Azure Sphere

Summary: Cisco Talos researchers discovered four vulnerabilities in Microsoft's Azure Sphere IoT platform: two could lead to unsigned code execution and two to privilege escalation, with TALOS-2020-1128 and TALOS-2020-1138 affecting version 20.07 and TALOS-2020-1133 and TALOS-2020-1137 affecting version 20.06. Talos worked with Microsoft under its coordinated disclosure policy, and Microsoft planned to assign CVEs on Oct. 13, 2020.
What you should know: Azure Sphere is built specifically for IoT security, and these bugs let specially crafted shellcode or a modified uid_map file run a user application under a system application's UID - so the platform's own isolation boundary is what failed.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026