{"id":"CVE-2026-119990","published":"2026-11-10T19:20:24.280","lastModified":"2026-11-11T05:19:28.737","description":"Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-306"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119990","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical missing authentication vulnerability (CWE-306) in Azure OpenAI allows unauthenticated remote attackers to perform privileged operations over the network. This enables full compromise of confidentiality, integrity, and availability due to the lack of any access control on a sensitive function.","exploitability":"Exploitation is trivial for any remote attacker with network access, requiring no authentication, privileges, or user interaction.","blast_radius":"Successful exploitation could allow attackers to fully compromise Azure OpenAI resources, including unauthorized model access, data exfiltration, service disruption, or lateral movement within the cloud environment.","remediation":"Microsoft has not published a fixed version in the description; apply immediate network-level restrictions to the affected Azure OpenAI endpoint(s), enforce strict IP allowlisting, and disable public access until authentication is properly implemented per vendor guidance.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","azure","elevation-of-privilege","critical","network"],"model":"garnet-coder","analyzedAt":"2026-11-11T09:51:01.028Z"}}