EUVD-2026-70793
GHSA-jh5m-2prj-924w
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Missing authentication on a network-reachable critical function gives PR:N/AV:N/AC:L; privilege elevation across the service boundary supports S:C with high C/I/A.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Privilege elevation in Microsoft's Azure AI Language cloud service lets a remote, unauthenticated attacker reach a critical function that lacks authentication (CWE-306), gaining elevated privileges over the network. Rated CVSS 10.0 with a scope change (S:C), the flaw is disclosed and fixed by Microsoft via MSRC; no public exploit code or CISA KEV listing is indicated, so this is no public exploit identified at time of analysis.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network access to the affected Azure AI Language function; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there is no authentication, no user interaction, and no special configuration required beyond the service being reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are consistently severe: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:C with C:H/I:H/A:H yields the maximum 10.0, meaning remote, unauthenticated, low-complexity exploitation with high impact across a changed scope. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Because Azure AI Language is a Microsoft-managed cloud service, the fix is deployed by Microsoft on the service side; patch available per vendor advisory (MSRC), with no customer-installable version specified in the input - consult https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70352 to confirm the service is remediated and whether any tenant-side action is required. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory Azure subscriptions to identify deployed Azure AI Language services and document current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today