What is the CVSS score of CVE-2026-32186?

CVE-2026-32186 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-32186?

Yes, a patch is available for CVE-2026-32186. Update the affected software to the latest version immediately.

Microsoft Bing CVE-2026-32186

EUVD-2026-18812 CRITICAL

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-03 microsoft

GHSA-2vw7-mrf4-v3mh

Microsoft SSRF Microsoft Bing

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Jul 24, 2026 - 22:23 vuln.today

cvss_changed

CVSS changed

Jul 24, 2026 - 22:23 NVD

10.0 (CRITICAL) 9.8 (CRITICAL)

EUVD ID Assigned

Apr 03, 2026 - 18:15 euvd

EUVD-2026-18812

Analysis Generated

Apr 03, 2026 - 18:15 vuln.today

Patch released

Apr 03, 2026 - 18:15 nvd

Patch available

CVE Published

Apr 03, 2026 - 17:22 nvd

CRITICAL 10.0

DescriptionNVD

Microsoft Bing Elevation of Privilege Vulnerability

Articles & Coverage 1

medium.com CVE-2026-32186: Microsoft Bing Elevation of Privilege via Service Trust Boundary Bypass

AnalysisAI

Microsoft Bing contains a server-side request forgery (SSRF) vulnerability that allows elevation of privilege through improperly validated requests. The flaw affects Microsoft Bing across all versions and enables attackers to bypass access controls and escalate privileges by causing the application to make unintended requests to internal or external resources. A vendor-released patch is available.

Technical ContextAI

The vulnerability stems from CWE-918 (Server-Side Request Forgery), which occurs when a web application fails to properly validate or sanitize user-supplied input before using it to construct server-side HTTP requests. In the context of Microsoft Bing, this allows attackers to manipulate the application into making requests to unintended targets, potentially accessing internal services, metadata endpoints, or privileged resources that should not be directly accessible. The affected component is the Microsoft Bing service itself (CPE: cpe:2.3:a:microsoft:microsoft_bing:*:*:*:*:*:*:*:*), indicating all versions are impacted.

RemediationAI

Apply the vendor-released patch from Microsoft immediately. Users should navigate to https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32186 for patch details and installation guidance. As this is a service-based vulnerability in Microsoft Bing, patching is typically applied server-side by Microsoft automatically; however, users should verify their instances are running the latest version. No interim workarounds are documented in the available advisory data; patching is the primary remediation path.