What is the CVSS score of CVE-2026-26121?

CVE-2026-26121 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Azure Iot Explorer are affected by CVE-2026-26121?

CVE-2026-26121 is a server-side request forgery vulnerability in Azure IoT Explorer that could allow attackers to spoof network requests and potentially access sensitive internal resources.. A patch is available.

How to fix or mitigate CVE-2026-26121?

Within 24 hours: Identify all systems running Azure IoT Explorer and assess whether they have network access to sensitive internal resources. Within 7 days: Implement network segmentation to restrict Azure IoT Explorer outbound access to only required endpoints and implement WAF rules to detect SSRF patterns. Within 30 days: Establish a vendor communication protocol to obtain and deploy the security patch immediately upon availability; consider alternative IoT management solutions if patch timeline extends beyond acceptable risk window.

Azure Iot Explorer CVE-2026-26121

HIGH

Improper Input Validation (CWE-20)

2026-03-10 secure@microsoft.com

SSRF Microsoft Azure Iot Explorer

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 7.5

DescriptionCVE.org

Server-side request forgery (ssrf) in Azure IoT Explorer allows an unauthorized attacker to perform spoofing over a network.

AnalysisAI

Azure IoT Explorer is vulnerable to server-side request forgery that enables unauthenticated network-based attackers to perform spoofing attacks and access sensitive information. The vulnerability requires no user interaction and can be exploited remotely with low attack complexity, affecting the confidentiality of exposed data. No patch is currently available.

Technical ContextAI

Classified as CWE-20 (Improper Input Validation). Server-side request forgery (ssrf) in Azure IoT Explorer allows an unauthorized attacker to perform spoofing over a network.