Azure AI Foundry CVE-2026-108456

Exploitation requires an authenticated identity with at least low privileges within Azure AI Foundry (PR:L) and network reachability to the service (AV:N); it is not exploitable by fully unauthenticated attackers. The exact feature, API, or request parameter that triggers the server-side request is not described in the available sources, so the precise configuration or input needed cannot be stated. Limiting factors: valid tenant/authenticated access is mandatory, no user interaction is involved (UI:N), and because this is a Microsoft-operated cloud service the vendor patch is likely applied server-side, reducing the window in which consumers remain exposed.

This is a genuine but moderate-priority issue rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) describes a network-reachable, low-complexity SSRF requiring an authenticated attacker with low privileges (PR:L), yielding high confidentiality impact with a scope change (S:C) but no integrity or availability impact. The temporal metrics are telling: E:U (exploit code unproven), RL:O (official remediation available), RC:C (confirmed). No EPSS score, no CISA KEV listing, and no PoC reference were supplied, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week' - consistent with a patchable, confirmed, but not-yet-exploited flaw: act promptly but it is not act_now/emergency. One point worth flagging: the description says the attacker can 'elevate privileges,' yet the CVSS impact set is C:H/I:N/A:N (confidentiality only), which reads more like information disclosure / access to otherwise-restricted internal resources than a classic integrity-bearing privilege escalation - the 'elevation' is best understood as the scope change (S:C) letting an authenticated tenant reach resources beyond its authorization boundary. Because Azure AI Foundry is a Microsoft-operated cloud service, the vendor-side patch is likely already applied in the hosted environment, lowering residual exposure for most consumers.

An attacker who already holds a low-privilege authenticated identity within Azure AI Foundry submits a crafted request that induces the service to make a server-side request to an internal or otherwise restricted endpoint. Because the vulnerability causes a scope change, the response lets the attacker read confidential data or internal resources beyond their authorized boundary. No public exploit code is identified, and exploitation requires valid authenticated access and network reachability (AV:N/AC:L).