EUVD-2026-95393
GHSA-cqq5-w7g3-vc36
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged authorized access
-
ExploitCraft request bypassing authorization check
-
ExecutionTrigger SSRF to internal/privileged endpoint
-
ImpactElevate privileges and access protected resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already possess a low-privileged but authorized identity within the Azure SRE Agent service (CVSS PR:L; the advisory explicitly describes an 'authorized attacker'), so this is not usable by fully anonymous attackers. Given CWE-918, the attacker must be able to supply or influence a resource/URL input that the agent fetches server-side, and the missing authorization check must be reachable with that input over the network (AV:N/AC:L/UI:N - no victim interaction needed). The principal limiting factor is the authentication prerequisite; the principal amplifier is that it is a managed cloud service, so there is no customer-controlled non-default configuration gating the flaw. |
| Impact | This is a genuine but conditional priority, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw requiring some existing privilege (PR:L), with high confidentiality and integrity impact but no availability impact (C:H/I:H/A:N), yielding 8.1 (High). The CWE-918 (SSRF) classification aligns with the 'elevate privileges over a network' description and the SSRF tag. Crucially, the signals converge rather than conflict toward 'serious but not actively exploited': EPSS is low at 0.39% (31st percentile), and CISA's SSVC framework rates Exploitation as 'none' and Automatable as 'no' - yet Technical Impact as 'total', consistent with the high C/I impact. There is no CISA KEV listing and no public POC, so this is no public exploit identified at time of analysis. The main caveat is that 'authorized attacker' plus PR:L confirms this needs a pre-existing authenticated foothold, which materially lowers real-world risk versus an unauthenticated RCE. Because Azure SRE Agent is a vendor-operated cloud service, the vendor-side patch likely remediates most tenants automatically, further reducing exposure. Net: patch-worthy and impactful if chained from an existing account, but EPSS/SSVC indicate targeted rather than widespread opportunistic exploitation. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged authorized identity within an Azure SRE Agent environment abuses the missing authorization check to issue a server-side request (SSRF) that the service processes with its own higher privileges. By directing that request at internal endpoints or management interfaces, the attacker reads sensitive data and performs actions beyond their intended role, elevating privileges. No public exploit code is known, and the low attack complexity (AC:L) means the request requires no special timing or race conditions once access is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Oct 15, 2026
Privilege escalation in Microsoft Azure SRE Agent lets an authenticated, low-privileged user exploit a missing authorization check in a server-side request-forwarding (SSRF) path to reach resources and act with the agent's higher-privileged identity, yielding high confidentiality and integrity impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Because the flaw sits in a Microsoft-managed cloud service, no customer-side configuration is required to trigger it - the only real gate is that the attacker must already hold a valid, authorized low-privileged identity in the service (PR:L, matching the advisory's 'authorized attacker' wording). Risk signals are moderate rather than urgent: EPSS is 0.39% (31st percentile), CISA SSVC records Exploitation: none and Automatable: no, and no public exploit has been identified at time of analysis; a vendor patch is available per Microsoft's advisory.
Earlier versions of this analysis (1)
Privilege elevation in Microsoft Azure SRE Agent allows an authenticated attacker who holds only low-privilege credentials inside a tenant to drive the agent into server-side requests that cross an authorization boundary, yielding high confidentiality and integrity impact (CVSS 9.6, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) under CWE-918. Exploitation is not anonymous - it requires a valid low-privilege identity in a tenant that has actually deployed the SRE Agent, needs no user interaction, and is scope-changing (S:C) because the agent's own privileged network position is leveraged to reach resources the caller could not otherwise touch. Microsoft has published an official fix through its MSRC update guide, and no public exploit code or confirmed active exploitation has been identified at time of analysis; the high base score is therefore best read as severity rather than as evidence of active abuse.
RemediationAI
Patch available per vendor advisory: Microsoft published remediation for CVE-2026-69435 in its MSRC Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69435), and because Azure SRE Agent is a Microsoft-managed service, the fix is applied by Microsoft on the service side rather than by customer installation - confirm with Microsoft's advisory and service health communications that your tenant is consuming the remediated service version, and re-test after the rollout. No exact customer-facing fix version number is published in the available data, so do not rely on a version string as evidence of remediation. Until your tenant is confirmed remediated, the most effective compensating control is to reduce who can reach the vulnerable path: audit and tighten Azure RBAC so that only trusted, minimized principals hold roles that can invoke the SRE Agent's request/resource-fetching operations, and remove standing assignments in favor of just-in-time elevation - the trade-off is added operational friction for legitimate automation operators. Where the agent supports private networking, force its outbound traffic through VNet integration, private endpoints, or an egress firewall with an allow-list of required Azure service endpoints, which blunts SSRF pivots to internal or arbitrary destinations at the cost of extra network configuration and possible breakage of legitimate agent integrations. Additionally, reduce the blast radius of the agent's own identity by reviewing and trimming its managed-identity permissions to the minimum required, and monitor agent-initiated requests for unexpected destinations or targets outside normal operational patterns; per the independent assessment, exploitation requires an already-authorized low-privileged identity, so identity governance changes here are meaningful mitigations rather than generic advice. No public exploit has been identified at time of analysis and CISA SSVC records Exploitation: none, so these measures can be sequenced with normal change management rather than emergency action.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Azure SRE Agent is Microsoft's managed site-reliability-engineering agent that runs inside an Azure tenant, connecting to Azure resources and observability data to perform automated operational tasks under its own service identity. The CVE is classified CWE-918 (Server-Side Request Forgery) alongside a stated missing-authorization condition, which together point to an agent endpoint that accepts or derives a resource/URL reference from the caller and then performs the fetch server-side without verifying that the requester is authorized for the target destination or for the operation being performed through the agent. The SSRF class matters here because the agent's outbound requests originate from an infrastructure identity with broader reach than the requesting user: an authenticated low-privileged user who can influence that URL/resource input can cause the agent to make requests on their behalf, effectively borrowing the agent's privileges. The CVSS vector confirms remote, low-complexity, no-user-interaction exploitation (AV:N/AC:L/UI:N) with unchanged scope (S:U), and that the attacker must be authenticated (PR:L), which is consistent with the advisory's 'authorized attacker' language; the confidentiality and integrity impact is high while availability is not affected. The supplied CPE (cpe:2.3:a:microsoft:azure_sre_agent:*:*:*:*:*:*:*:*) uses a wildcard version, indicating the advisory does not enumerate specific affected builds, which is typical for a cloud-hosted service remediated centrally by the vendor. Independent assessment rates this a genuine but conditional priority: the privilege prerequisite is the limiting factor, and the managed-service nature (no customer-tunable non-default configuration to gate the flaw) is the amplifying factor.
Know when Azure Sre Agent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable SSRF needing an existing low-privileged authorized account (PR:L), no user interaction, high confidentiality/integrity via server-side requests but no availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
A high-severity privilege escalation in Microsoft Azure SRE Agent could let an authenticated low-privileged user exploit the service's own higher-privileged identity against connected resources, risking unauthorized access to sensitive data and unauthorized changes. Because the flaw is in a Microsoft-managed service and no public exploit identified at time of analysis, the immediate management priority is to apply the vendor patch and tighten access for low-privileged identities.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
More in Azure Sre Agent
View allPrivilege elevation in Microsoft's Azure SRE Agent lets an already-authorized, low-privilege network actor gain higher p
Information disclosure in Azure SRE Agent can be exploited by remote unauthenticated attackers via improper authenticati
Exploit-DB