CVE-2026-70352: CWE-306: Missing Authentication for Critical Function in Microsoft Azure AI Language Authoring
Description
CVE-2026-70352 is a critical vulnerability in Microsoft Azure AI Language Authoring where a missing authentication for a critical function allows unauthorized attackers to elevate privileges over a network. The vulnerability has a CVSS score of 10.0, indicating maximum severity with high impact on confidentiality, integrity, and availability. Microsoft has issued an official fix for this cloud-hosted service, and remediation is managed by the vendor.
CVSS v3.1
Score 10.0critical
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-306) in Azure AI Language Authoring involves missing authentication on a critical function, enabling an attacker without prior privileges to elevate their privileges remotely. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and high impact on confidentiality, integrity, and availability. The service is cloud-hosted, and Microsoft has provided an official fix to address the issue.
Potential Impact
An attacker can exploit this vulnerability remotely without authentication to gain elevated privileges, potentially compromising the confidentiality, integrity, and availability of the Azure AI Language Authoring service. This could lead to unauthorized access and control over critical functions within the service.
Mitigation Recommendations
Microsoft has released an official fix for this vulnerability. Since Azure AI Language Authoring is a cloud service, Microsoft manages the remediation server-side. Users should verify that their service instances are updated according to Microsoft's advisory to ensure the vulnerability is mitigated.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jh5m-2prj-924w
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-70352"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
- Remediation Level
- official-fix
- Is Cloud Service
- true
- State
- PUBLISHED
Threat ID: 6a9ad4f9acd9273b49b67a8e
Added to database: 09/04/2026, 14:26:01 UTC
Last enriched: 10/08/2026, 22:43:20 UTC
Last updated: 10/19/2026, 18:48:23 UTC
Views: 70
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.