EUVD-2026-48451
GHSA-674h-75hr-643h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable SSRF exploitable by an authenticated low-privilege tenant user (PR:L) with no interaction; forged internal access yields high confidentiality, integrity, and availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Privilege elevation via server-side request forgery affects Microsoft Azure AI Search, allowing an already-authorized, low-privileged attacker to coerce the service into making crafted network requests to internal or restricted endpoints. By abusing this SSRF, an attacker can reach backend resources and metadata services normally unreachable from their privilege tier, resulting in high confidentiality, integrity, and availability impact (CVSS 8.8). No public exploit identified at time of analysis, and the EPSS score of 0.38% (31st percentile) alongside a CISA SSVC 'Exploitation: none' rating indicates no observed exploitation yet.
Technical ContextAI
Azure AI Search (formerly Azure Cognitive Search) is Microsoft's managed cloud search-as-a-service that indexes and queries content, often pulling data from external and internal data sources, skillsets, and enrichment pipelines that make outbound HTTP requests. The root cause is CWE-918 (Server-Side Request Forgery): the service fetches a URL or resource whose destination is influenced by attacker-controlled input without adequately validating or restricting the target, letting the server be tricked into requesting unintended internal endpoints. In cloud PaaS contexts, SSRF is particularly dangerous because the service backend may have implicit trust to reach control-plane APIs, instance metadata endpoints, or other tenants' isolated resources, converting a request-forgery bug into privilege elevation. The affected component is identified by CPE cpe:2.3:a:microsoft:azure_ai_search:*:*:*:*:*:*:*:* as a Microsoft-operated service rather than an on-premises installable version.
RemediationAI
Patch available per vendor advisory: Microsoft has remediated this vulnerability server-side, as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56167 - because Azure AI Search is a Microsoft-managed cloud service, the fix is applied to the platform automatically and customers do not install an update, so verify remediation status via the MSRC update guide rather than a local upgrade. As defense-in-depth, tenants should review and tighten who holds contributor/query and data-source configuration privileges (the low-privilege access this attack requires), audit search service data sources, skillsets, and indexers for unexpected or attacker-supplied outbound URLs, and enforce network isolation such as private endpoints and restricted outbound connectivity to limit what the service can reach if an SSRF vector recurs. These controls reduce blast radius but do not substitute for the vendor fix; confirm the service is running the patched platform version. No customer-side version number applies, so do not expect a discrete package to install.
More in Azure Ai Search
View allSame weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today