Vulnerability Spotlight: Microsoft issues security update for Azure Sphere
Summary: Cisco Talos researchers discovered seven vulnerabilities in Microsoft's Azure Sphere, the cloud-connected SoC platform built for IoT security, with two chainable flaws allowing arbitrary writes to the /mnt/config partition and two others enabling shellcode execution in the restricted Linux userland of the A7 core. The remaining issues include an information disclosure via the kernel message ring buffer, a denial-of-service through resource exhaustion in the Pluton ring buffer, and a memory corruption flaw in the AZSPIO socket kernel driver, with Microsoft planning to assign CVEs on Oct. 13.
Why it matters: Azure Sphere exists specifically to guarantee that only signed code runs on IoT devices, and Talos found two separate ways to execute unsigned shellcode in that protected userland - the exact assurance the platform was sold on.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026