EUVD-2026-18561
GHSA-ccr7-c63m-8vgm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated network request to Azure AI Foundry
-
ExploitExploit improper authorization check
-
ExecutionEscalate privileges to administrative level
-
ImpactAccess sensitive resources across tenants
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization verification
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Remote unauthenticated attacker can exploit Azure AI Foundry default configurations without special prerequisites. CVSS:3.1 with AV:N/AC:L/PR:N/UI:N indicates no authentication, interaction, or complex conditions required. Affects networked deployments of Azure AI Foundry. |
| Impact | Real-world risk is critically high despite absence of confirmed exploitation signals. The CVSS 10.0 score accurately reflects severity: network attack vector (AV:N) enables internet-facing exploitation, low complexity (AC:L) requires no special conditions, no privileges required (PR:N) means unauthenticated access, no user interaction (UI:N) allows automated attacks, and changed scope (S:C) indicates lateral movement or boundary escape. Authentication bypass in cloud infrastructure affects all tenant environments, enabling data exfiltration, model manipulation, or resource hijacking. The Microsoft security tag confirms vendor acknowledgment and likely emergency patching. Without EPSS data, assume elevated exploitation probability given cloud service exposure and high-value target profile. Exploitation is highly automatable once discovered, making this a priority-zero patch regardless of current KEV or POC status. Organizations using Azure AI Foundry face immediate compromise risk until remediation. |
| Exploit ScenarioDerived | An unauthenticated remote attacker identifies publicly accessible Azure AI Foundry API endpoints through reconnaissance of an organization's cloud infrastructure. Exploiting the improper authorization flaw with low complexity, the attacker submits crafted requests that bypass authentication checks and gain administrative privileges within the AI platform. With elevated access, the attacker exfiltrates sensitive training data and proprietary machine learning models, deploys malicious models to poison production AI systems, or pivots laterally to other Azure resources within the tenant boundary. The changed scope allows potential escape from logical isolation, enabling cross-tenant data access in multi-tenant deployments. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 03, 2026
Azure AI Foundry improper authorization permits unauthenticated remote attackers to escalate privileges and achieve complete compromise with high impact to confidentiality, integrity, and availability. The CVSS 10.0 rating reflects network-based attack vector with low complexity, no user interaction, and scope change indicating containerization/isolation escape. EPSS and KEV status not provided, but the authentication bypass affecting a cloud AI platform poses severe risk. No public exploit identified at time of analysis.
RemediationAI
Apply security updates immediately per Microsoft Security Response Center guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32213. Exact patched version numbers were not provided in available intelligence; consult the vendor advisory for deployment-specific update procedures. Given the cloud-managed nature of Azure AI Foundry, Microsoft may deploy server-side fixes automatically, but customers should verify patch application status through Azure portal or service health dashboard. Until confirmation of remediation, implement compensating controls: restrict network access to Azure AI Foundry endpoints using firewall rules or virtual network service endpoints, enable enhanced logging and monitoring for unauthorized privilege escalation attempts, review and audit existing user permissions and API access tokens, and consider temporarily suspending non-critical AI workloads if business continuity allows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in microsoft
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability stems from CWE-285 (Improper Authorization), indicating flawed access control enforcement in Azure AI Foundry's permission model. Azure AI Foundry is Microsoft's platform for building, deploying, and managing AI applications and models. The authorization defect allows attackers to bypass authentication gates entirely, gaining unauthorized access to privileged operations. The Changed scope (S:C) in the CVSS vector suggests the vulnerability may enable escape from logical boundaries such as tenant isolation or container boundaries within the multi-tenant cloud environment, allowing impact beyond the vulnerable component itself. This class of authorization flaw typically arises from missing or incorrect permission checks in API endpoints, middleware layers, or role-based access control (RBAC) implementations.
Know when Azure Ai Foundry gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
Executive ViewAI
Azure AI Foundry contains a critical authorization flaw (CVSS 10.0) allowing unauthenticated remote attackers to escalate privileges and achieve complete system compromise, affecting confidentiality, integrity, and availability across all deployments. Organizations using Azure AI Foundry face immediate risk of data theft, service disruption, and unauthorized access to AI models and training data without requiring valid credentials. This vulnerability demands urgent isolation and monitoring until a vendor patch is released.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to Azure AI Foundry via firewall/NSG rules allowing only authorized IP ranges and VPN; (2) Disable public internet exposure-require VPN or private endpoint connectivity; (3) Enforce multi-factor authentication and conditional access policies at the Azure identity layer to add friction despite authorization bypass; (4) Deploy real-time behavioral analytics and anomaly detection to flag unauthorized privilege escalation attempts; (5) Isolate affected AI Foundry instances from production data pipelines pending patch availability; (6) Increase audit logging verbosity and forward logs to SIEM for continuous threat detection; (7) Maintain air-gapped backup copies of critical models and datasets.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in Azure Improper Authorization Issues
View all 2More in Azure Ai Foundry
View allImproper access control in Microsoft Azure AI Foundry agents published to Microsoft 365 lets unauthenticated remote atta
Unauthenticated remote attackers can reach a critical function inside Microsoft Azure AI Foundry that performs a privile
Server-side request forgery in Azure AI Foundry can be exercised by an authenticated user with low privileges over the n
Server-side request forgery in Azure AI Foundry allows remote unauthenticated attackers to cause high confidentiality lo
Exploit-DB