Azure OpenAI Elevation of Privilege Vulnerability
CVE-2026-119990 is an elevation of privilege vulnerability in Azure OpenAI (rated Critical, CVSS 9.8). Microsoft fixed it in the service; customers need to do nothing.
1 version
Facts
- Microsoft id
CVE-2026-119990- Products
- Azure OpenAI
- Severity
- Critical
- Impact
- Elevation of Privilege
- CVSS
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Customer action required
- No
- Release
- 2026-Nov
- Assigned by
- Microsoft
- Weakness
- CWE-306: Missing Authentication for Critical Function
- MSRC revision
- 1.1
- Status pages
- Azure OpenAI Service status
- First captured by us
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2026-11-10:
Information published.
- Revision 1.1, 2026-11-10:
Updated the Customer Action Required information and FAQ to clarify that Microsoft has fully mitigated this vulnerability and no customer action is required.
Microsoft says
Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page
Related changes
Other changes for Azure OpenAI Service
- Public preview: Azure Functions extension for OpenAI · In preview
- OpenAI Whisper model in preview in Azure OpenAI service and Azure AI Speech · In preview
- Azure OpenAI Elevation of Privilege Vulnerability
- Introducing GPT-4o: OpenAI’s new flagship multimodal model now in preview on Azure · In preview
- Announcing the General Availability of GPT-4 Turbo with Vision on Azure OpenAI Service · Launched
- Public Preview: Azure OpenAI Service On Your Data · In preview
- Azure Machine Learning - Public Preview for July · In preview
- Azure Machine Learning - Public Preview for October · In preview
Last updated