CVE-2026

Api.Msrc.Microsoft • September 9, 2026

We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking “Manage Cookies” at the bottom of the page. Privacy Statement Third-Party Cookies

Released: Jul 2, 2026

Last updated: Sep 9, 2026

Please see Common Vulnerability Scoring System for more information on the definition of these metrics.

Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?

This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.

Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle .

Updated an acknowledgement. This is an informational change only.

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Disclosed in Azure Services Two critical vulnerabilities were disclosed in Microsoft Azure services. CVE-2026-45499 involves a server-side request forgery (SSRF) in Azure OpenAI, allowing privilege escalation for authorized attackers. This vulnerability has been fully mitigated, requiring no action from users. CVE-2026-77909 pertains to insufficiently protected credentials in Azure CycleCloud, which could lead to credential disclosure over a network. The latter vulnerability was published on September 8, 2026, and affects Azure CycleCloud users. Microsoft has not reported any active exploitation for either vulnerability, and both have been addressed in their respective advisories. 4 sources 22

Extracted Entities

CVE-2026

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (1)