What is the CVSS score of CVE-2026-32169?

CVE-2026-32169 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by CVE-2026-32169?

A critical vulnerability in Azure Cloud Shell (CVE-2026-32169) enables attackers to bypass authentication and gain unauthorized elevated network access without requiring a patch.. A patch is available.

How to fix or mitigate CVE-2026-32169?

Within 24 hours: Audit all Azure Cloud Shell access logs for suspicious activity; disable Cloud Shell access for non-essential users and implement MFA enforcement. Within 7 days: Deploy network segmentation to restrict Cloud Shell instances from accessing sensitive internal systems; implement WAF rules to block suspicious SSRF patterns. Within 30 days: Conduct full cloud infrastructure assessment for unauthorized access; establish Cloud Shell usage policies requiring approval; monitor vendor communications for patch availability.

Microsoft CVE-2026-32169

EUVD-2026-13204 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-19 secure@microsoft.com

SSRF Microsoft

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 21:30 euvd

EUVD-2026-13204

Analysis Generated

Mar 19, 2026 - 21:30 vuln.today

CVE Published

Mar 19, 2026 - 21:17 nvd

CRITICAL 10.0

DescriptionCVE.org

Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Azure Cloud Shell contains a server-side request forgery vulnerability that allows unauthenticated remote attackers to escalate privileges without user interaction. The vulnerability affects Microsoft products and has a critical CVSS score of 10.0, though no patch is currently available. Attackers can leverage network access to achieve privilege elevation across system boundaries.

Technical ContextAI

Server-side request forgery (SSRF) vulnerabilities, classified under CWE-918, occur when an application can be tricked into making HTTP requests to arbitrary destinations on behalf of the server, potentially accessing internal resources or bypassing security controls. Azure Cloud Shell is a browser-based command-line interface that provides authenticated access to manage Azure resources through either Bash or PowerShell environments. The SSRF vulnerability in this cloud-based terminal service could allow attackers to make unauthorized requests from within Microsoft's infrastructure, potentially accessing internal Azure services, metadata endpoints, or other restricted resources that would normally be inaccessible from the public internet.

RemediationAI

Microsoft has not yet released specific version information or patches for this vulnerability based on the available references. Organizations should monitor the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32169 for updates on patches or mitigations. Until a fix is available, consider implementing compensating controls such as restricting Azure Cloud Shell access to trusted IP ranges through Conditional Access policies, enabling additional monitoring and alerting for unusual Cloud Shell activities, and reviewing Azure Activity Logs for suspicious command executions or network requests originating from Cloud Shell sessions.