Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Azure OpenAI lets attackers gain higher rights

CVE-2026-119990 · published 1 day ago
Summary

The Azure OpenAI service contains a function that does not require proper authentication, allowing someone without permission to increase their access level. This could let an attacker move from a basic user to a more powerful account across the network. Apply the latest security updates from Microsoft and review access controls to ensure only authorized users can call this function.

What to do
  • Update microsoft azure open ai to version hyena-infra-build-official/20260923.14 or later.
Affected software
VendorProductAffected versions
microsoft azure open ai < hyena-infra-build-official/20260923.14
Original advisory text
Azure OpenAI Elevation of Privilege Vulnerability
Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published10 Nov 2026
Updated12 Nov 2026
First seen10 Nov 2026
Sources
CVE-2026-119990 · NVD
CVE-2026-119990 · MITRE
Track software like this
Free during beta