This vulnerability (CVE-2026-26135) involves SSRF in the Azure Custom Locations Resource Provider, enabling an attacker with some level of authorization to perform unauthorized network requests, potentially leading to privilege escalation. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality and integrity. Microsoft has published an official fix and is responsible for patching the cloud service.

An authorized attacker exploiting this SSRF vulnerability can elevate privileges within the network, compromising confidentiality and integrity of data or resources managed by the Azure Custom Locations Resource Provider. Availability impact is not indicated. No known exploits in the wild have been reported.

Microsoft has released an official fix for this vulnerability and manages remediation for the Azure Custom Locations Resource Provider as a cloud service. Users should follow the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26135 for current status and ensure their Azure environment is updated accordingly.