CVE-2026-108456: CWE-918: Server-Side Request Forgery (SSRF) in Microsoft Azure AI Foundry

This vulnerability, identified as CWE-918, involves a server-side request forgery flaw in Azure AI Foundry. An attacker with some level of authorization can exploit this SSRF to elevate privileges within the network context of the service. The CVSS v3.1 base score is 7.7, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and a scope change with high confidentiality impact. Microsoft manages remediation for this cloud-hosted service and has released an official fix as detailed in their security update guide.

An authorized attacker can leverage this SSRF vulnerability to elevate privileges over the network, potentially gaining unauthorized access to sensitive information. The impact affects confidentiality with no reported impact on integrity or availability. There are no known exploits in the wild at this time.

Microsoft has released an official fix for this vulnerability. As Azure AI Foundry is a cloud service, Microsoft manages the remediation server-side. Users should consult the Microsoft security update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108456 for confirmation of patch deployment and further guidance.