Roberto Tejero @azurebrains

🚨 CVE‑2026‑20965: Azure Identity Token Flaw Enables Tenant‑Wide Compromise via Windows Admin Center Cymulate Research Labs has disclosed a high‑severity vulnerability in the Azure AD Single Sign‑On (SSO) integration of Windows Admin Center (WAC). The flaw allows an attacker with local administrator rights on a single machine to escalate privileges, execute remote code, and move laterally across all Azure VMs and Arc‑connected systems within the same tenant—even without valid Azure credentials. Any Azure VM or Arc‑joined machine running an unpatched Windows Admin Center Azure Extension below version 0.70.00 is exposed. Since version 0.69.0.0 was only released in January 2026, this effectively means all deployments with the WAC Azure extension are at risk unless updated. For defenders, the critical questions now are: What is the blast radius, and which internet‑facing Azure or Arc‑connected VMs are running the vulnerable WAC Azure extension? These systems could provide attackers with a foothold for remote code execution and lateral movement across the tenant. The below Defender XDR advance hunting KQL query that helps security teams quickly identify Azure and Arc‑joined VMs running the WAC Azure extension so they can prioritize patching and containment.🫡 #Cybersecurity #WACAzureExtension #RCE #DefenderXDR

🌐 Hunting DarkSpectre Built a KQL detection to hunt DarkSpectre — the actor behind 7.8M infected browsers. Defenders can now spot suspicious extensions faster.🫡 koi.ai/blog/darkspectre-unma… github.com/SlimKQL/Detection… #Cybersecurity #DarkSpectre #RiskyExtension #DefenderXDR

🥷Microsoft Incident Response Ninja Hub (Updated 28 Dec 2025) 🛡️ Dive into: - Expert-led guides & best practices - Threat hunting & cloud forensics tips - Ransomware & APT case studies - One-page investigation playbooks - KQL techniques & recovery strategies techcommunity.microsoft.com/… #Cybersecurity #MicrosoftIRHub