{"id":1026,"date":"2026-08-24T03:04:14","date_gmt":"2026-08-24T00:04:14","guid":{"rendered":"https:\/\/www.tayfnews.tech\/tr\/?p=1026"},"modified":"2026-08-24T03:04:14","modified_gmt":"2026-08-24T00:04:14","slug":"microsoft-en-yuksek-ciddiyetteki-kod-yurutme-ve-ayricalik-yukseltme-aciklarini-kapatti","status":"publish","type":"post","link":"https:\/\/www.tayfnews.tech\/tr\/breaking-news\/microsoft-en-yuksek-ciddiyetteki-kod-yurutme-ve-ayricalik-yukseltme-aciklarini-kapatti\/","title":{"rendered":"Microsoft, En Y\u00fcksek Ciddiyetteki Kod Y\u00fcr\u00fctme ve Ayr\u0131cal\u0131k Y\u00fckseltme A\u00e7\u0131klar\u0131n\u0131 Kapatt\u0131"},"content":{"rendered":"

Microsoft, En Y\u00fcksek Ciddiyetteki Kod Y\u00fcr\u00fctme ve Ayr\u0131cal\u0131k Y\u00fckseltme A\u00e7\u0131klar\u0131n\u0131 Kapatt\u0131<\/h1>\n

Microsoft; Entra ID, Azure Arc ve Exchange Online’da sald\u0131rganlar\u0131n uzaktan kod y\u00fcr\u00fctmesine ve ayr\u0131cal\u0131k y\u00fckseltmesine olanak tan\u0131yan en y\u00fcksek ciddiyetteki birden fazla a\u00e7\u0131\u011f\u0131 kapatt\u0131. Eski ad\u0131yla Azure Active Directory (veya Azure AD) olarak bilinen bu bulut tabanl\u0131 IAM platformu; Microsoft 365, Azure veya Dynamics CRM Online m\u00fc\u015fterilerine uygulama ve kaynaklar genelinde kimlik do\u011frulama, ilke uygulamas\u0131 ve koruma sa\u011fl\u0131yor.<\/p>\n

Microsoft’un ba\u015f g\u00fcvenlik m\u00fchendisi Robert Fitzpatrick taraf\u0131ndan ke\u015ffedilen ve CVE-2026-69836 olarak takip edilen ilk a\u00e7\u0131k, Entra ID bulut tabanl\u0131 IAM platformunda yer alan ve hi\u00e7bir ayr\u0131cal\u0131\u011f\u0131 olmayan tehdit akt\u00f6rlerinin d\u00fc\u015f\u00fck karma\u015f\u0131kl\u0131kl\u0131 sald\u0131r\u0131larda kod y\u00fcr\u00fctmesini sa\u011flayan kritik bir zafiyetti. Per\u015fembe g\u00fcn\u00fc yay\u0131nlanan bir g\u00fcvenlik b\u00fclteninde Microsoft, “Microsoft Entra ID’deki g\u00fcvenilmeyen verilerin seri durumdan \u00e7\u0131kar\u0131lmas\u0131, yetkisiz bir sald\u0131rgan\u0131n bir a\u011f \u00fczerinden kod \u00e7al\u0131\u015ft\u0131rmas\u0131na olanak tan\u0131r” a\u00e7\u0131klamas\u0131nda bulundu. Microsoft d\u00fcn ayr\u0131ca, \u00fc\u00e7\u00fc kimlik do\u011frulamas\u0131 gerektirmeyen sald\u0131rganlar\u0131n Azure Arc (CVE-2026-65816 ve CVE-2026-69555) ile Exchange Online (CVE-2026-65801) \u00fczerinde uzaktan ayr\u0131cal\u0131k y\u00fckseltmesine olanak tan\u0131yanlar dahil olmak \u00fczere en y\u00fcksek ciddiyetteki d\u00f6rt a\u00e7\u0131\u011f\u0131 daha giderdi.<\/p>\n

Kapat\u0131lan A\u00e7\u0131klar\u0131n Detaylar\u0131 ve G\u00fcvenlik Ba\u011flam\u0131<\/h2>\n

CVE-2026-65770 olarak takip edilen d\u00f6rd\u00fcnc\u00fc a\u00e7\u0131k ise Azure Apache Cassandra Y\u00f6netilen \u00d6rne\u011fi \u00fczerinde uzaktan kod y\u00fcr\u00fct\u00fclmesini m\u00fcmk\u00fcn k\u0131l\u0131yordu. Microsoft, bu zafiyetler i\u00e7in hen\u00fcz \u00e7evrim i\u00e7i olarak sunulan bir istismar kodunun bulunmad\u0131\u011f\u0131n\u0131 belirtirken, a\u00e7\u0131klar halihaz\u0131rda tamamen kapat\u0131ld\u0131\u011f\u0131 i\u00e7in kullan\u0131c\u0131lar\u0131n herhangi bir i\u015flem yapmas\u0131na gerek olmad\u0131\u011f\u0131n\u0131 ekledi. Microsoft’a g\u00f6re \u015firket, g\u00fcvenlik b\u00fcltenlerini “daha fazla \u015feffafl\u0131k sa\u011flamak amac\u0131yla” yay\u0131nlad\u0131.<\/p>\n

Eyl\u00fcl 2025’te Outsider Security g\u00fcvenlik ara\u015ft\u0131rmac\u0131s\u0131 Dirk-jan Mollema taraf\u0131ndan bildirilen ve sald\u0131rganlar\u0131n d\u00fcnyadaki her \u015firketin Microsoft Entra ID kirac\u0131s\u0131na tam eri\u015fim kazanmas\u0131n\u0131 sa\u011flayan bir ba\u015fka kritik Entra ID ayr\u0131cal\u0131k y\u00fckseltme a\u00e7\u0131\u011f\u0131 (CVE-2025-55241) kapat\u0131lm\u0131\u015ft\u0131. CISA ayr\u0131ca Cuma g\u00fcn\u00fc, Windows \u0130nternet Anahtar De\u011fi\u015fimi (IKE) Hizmet Uzant\u0131lar\u0131 bile\u015fenindeki kritik ciddiyetteki bir uzaktan kod y\u00fcr\u00fctme (RCE) a\u00e7\u0131\u011f\u0131n\u0131 aktif olarak istismar edilenler aras\u0131na ekledi. Microsoft’un CVE-2026-69836 a\u00e7\u0131\u011f\u0131n\u0131 yanl\u0131\u015fl\u0131kla sahada istismar edilmi\u015f olarak etiketledi\u011fini belirten a\u00e7\u0131klamas\u0131n\u0131n ard\u0131ndan haber d\u00fczeltildi.<\/p>\n

Sald\u0131rganlar ge\u00e7erli kimlik bilgilerine sahip oldu\u011funda, eylemlerinin yaln\u0131zca %37’si engelleniyor. Genel \u00f6nleme puanlar\u0131, ilk eri\u015fimden sonra ne oldu\u011funu gizleyebilir. Sald\u0131rganlar ge\u00e7erli kimlik bilgilerini kulland\u0131\u011f\u0131nda \u00f6nleme oranlar\u0131 keskin bir \u015fekilde d\u00fc\u015f\u00fcyor. The Blue Report 2026, m\u00fc\u015fteri \u00fcretim ortamlar\u0131nda y\u00fcr\u00fct\u00fclen 338 milyon sim\u00fclasyon \u00fczerinden savunmalar\u0131 teknik teknik \u00f6l\u00e7\u00fcyor.<\/p>\n

Kaynak: Orijinal Makale<\/a><\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Microsoft, Entra ID, Azure Arc ve Exchange Online’da uzaktan kod y\u00fcr\u00fctmeye ve ayr\u0131cal\u0131k y\u00fckseltmeye izin veren en y\u00fcksek ciddiyetteki a\u00e7\u0131klar i\u00e7in yama yay\u0131nlad\u0131.<\/p>\n","protected":false},"author":1,"featured_media":1025,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"googlesitekit_rrm_CAowrrDMDA:productID":"","tayfnews_source_url":"","footnotes":"","rank_math_focus_keyword":"Microsoft yamalar\u0131, Entra ID a\u00e7\u0131\u011f\u0131, Azure Arc g\u00fcvenlik a\u00e7\u0131\u011f\u0131, Exchange Online, kod y\u00fcr\u00fctme a\u00e7\u0131\u011f\u0131, ayr\u0131cal\u0131k y\u00fckseltme","rank_math_title":"Microsoft, En Y\u00fcksek Ciddiyetteki Kod Y\u00fcr\u00fctme ve Ayr\u0131cal\u0131k Y\u00fckseltme A\u00e7\u0131klar\u0131n\u0131 Kapatt\u0131","rank_math_description":"Microsoft, Entra ID, Azure Arc ve Exchange Online'da uzaktan kod y\u00fcr\u00fctmeye ve ayr\u0131cal\u0131k y\u00fckseltmeye izin veren en y\u00fcksek ciddiyetteki a\u00e7\u0131klar i\u00e7in yama yay\u0131nlad\u0131."},"categories":[12],"tags":[],"class_list":["post-1026","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-breaking-news"],"_links":{"self":[{"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/posts\/1026","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/comments?post=1026"}],"version-history":[{"count":1,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/posts\/1026\/revisions"}],"predecessor-version":[{"id":1027,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/posts\/1026\/revisions\/1027"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/media\/1025"}],"wp:attachment":[{"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/media?parent=1026"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/categories?post=1026"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tayfnews.tech\/tr\/wp-json\/wp\/v2\/tags?post=1026"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}