Azure
CVE-2026-22048
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use Microsoft Entra ID (formerly Azure AD) as an IdP are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. Successful exploit could allow an authenticated attacker with low privileges to delete configuration data or deny access to some resources.
AnalysisAI
Configuration deletion and resource denial in StorageGRID versions before 11.9.0.12 and 12.0.0.4 stems from an SSRF flaw in Microsoft Entra ID SSO integration, allowing authenticated attackers to manipulate backend requests. Successful exploitation enables deletion of configuration data or denial of access to storage resources despite requiring valid credentials to initiate the attack.
Technical ContextAI
Classified as CWE-918 (Server-Side Request Forgery (SSRF)). Affects version. StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.12 and 12.0.0.4 with Single Sign-on enabled and configured to use Microsoft Entra ID (formerly Azure AD) as an IdP are susceptible to a Server-Side Request Forgery (SSRF) vulnerability. Successful exploit could allow an authenticated attacker with low privileges to delete configuration data or deny access to some resources.
Affected ProductsAI
Product: version. Versions: up to 11.9.0.12.
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Privilege escalation in Microsoft's Azure Billing service allows unauthenticated, remote attackers to reach full comprom
Path traversal in pnpm's tarball extraction on Windows allows attackers to write files outside the intended package dire
Default password in Himmelblau Azure Entra ID suite 3.0.0-3.0.x. CVSS 10.0.
Privilege escalation in Azure Database for PostgreSQL allows an authenticated attacker with low privileges to elevate pr
Path traversal in Microsoft's Azure Logic Apps (CWE-22) lets a remote, unauthenticated attacker escape an intended restr
Default credentials in Cisco ISE cloud deployments on AWS/Azure/OCI. CVSS 9.9.
Unauthenticated remote attackers can reach a critical function inside Microsoft Azure AI Foundry that performs a privile
Deserialization of untrusted data in Azure SDK allows unauthorized code execution over a network. EPSS 0.32%.
Elevation of privilege vulnerability in Azure Front Door allows attackers to gain elevated access. Microsoft Azure cloud
Azure Front Door has an improper access control vulnerability (CVSS 9.8) allowing unauthorized attackers to elevate priv
Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier.
Fleet device management software has a signature verification bypass that allows attackers to install malicious firmware
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today