How to fix CVE-2026-26135?

24 hours: Inventory all Azure Custom Locations Resource Provider deployments and document which users/service principals have authenticated access. Identify and document all sensitive resources (databases, key vaults, storage accounts) that Custom Locations can currently reach. 7 days: Implement network segmentation to restrict Custom Locations instances from accessing sensitive backend resources; apply principle of least privilege by removing unnecessary resource access permissions for accounts using Custom Locations. Review audit logs for Custom Locations activity in the past 90 days to detect unauthorized access patterns. 30 days: Monitor Microsoft Security Response Center (MSRC) and Azure advisories for patch release; apply the patch immediately upon availability to all affected Custom Locations instances. Re-evaluate compensating controls post-patch.

Is Microsoft affected by CVE-2026-26135?

A critical server-side request forgery (SSRF) vulnerability in Azure Custom Locations Resource Provider allows authenticated users with low-level permissions to escalate privileges and access sensitive data across security boundaries within Azure infrastructure.

CVE-2026-26135

EUVD-2026-18556 CRITICAL

2026-04-03 [email protected]

9.6

CVSS 3.1

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 03, 2026 - 00:22 vuln.today

EUVD ID Assigned

Apr 03, 2026 - 00:22 euvd

EUVD-2026-18556

CVE Published

Apr 03, 2026 - 00:16 nvd

CRITICAL 9.6

Description

Server-side request forgery (ssrf) in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges over a network.

Analysis

Server-side request forgery in Azure Custom Locations Resource Provider enables authenticated attackers with low-level privileges to elevate access and exfiltrate sensitive data across scope boundaries via network-based SSRF exploitation. This vulnerability affects Microsoft Azure infrastructure with a CVSS score of 9.6 (Critical), featuring scope change that allows attackers to reach resources beyond the vulnerable component's security context. …

Remediation

24 hours: Inventory all Azure Custom Locations Resource Provider deployments and document which users/service principals have authenticated access. Identify and document all sensitive resources (databases, key vaults, storage accounts) that Custom Locations can currently reach. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +0.1

CVSS: +48

POC: 0

CVE-2026-26135 vulnerability details – vuln.today

Back

CVE-2026-26135

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Analysis

Full analysis requires sign-in

Priority Score

Share

CVE-2026-26135

CVSS Vector

Lifecycle Timeline

Tags

Description

Analysis

Remediation

Full analysis requires sign-in

Priority Score

Share

External POC / Exploit Code