This vulnerability (CVE-2026-26135) involves SSRF in the Azure Custom Locations Resource Provider, enabling an authorized attacker to perform privileged network actions. The flaw is classified under CWE-918 and affects the cloud-hosted service managed by Microsoft. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, scope change, and high confidentiality and integrity impacts. Microsoft has published an official fix and manages remediation server-side for this cloud service.

An authorized attacker exploiting this SSRF vulnerability can elevate privileges within the network context of the Azure Custom Locations Resource Provider, potentially leading to unauthorized access to sensitive data and control over network resources. The confidentiality and integrity impacts are rated high, while availability is not affected.

Microsoft has released an official fix for this vulnerability and manages remediation for the Azure Custom Locations Resource Provider as a cloud service. Users should ensure their Azure environment is updated according to Microsoft's guidance available at the official advisory URL. No additional user action is required beyond applying the official fix.