Azure OpenAI Elevation of Privilege Vulnerability
CVE-2026-45499 is an elevation of privilege vulnerability in Azure OpenAI (rated Critical, CVSS 9.9). Microsoft fixed it in the service; customers need to do nothing.
1 version
Facts
- Microsoft id
CVE-2026-45499- Products
- Azure OpenAI
- Severity
- Critical
- Impact
- Elevation of Privilege
- CVSS
- 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
- Exploited
- No
- Publicly disclosed
- No
- Customer action required
- No
- Release
- 2026-Jul
- Assigned by
- Microsoft
- Weakness
- CWE-918: Server-Side Request Forgery (SSRF)
- MSRC revision
- 2.0
- Status pages
- Azure OpenAI Service status
- First captured by us
- (from our first import of this list)
- Microsoft last modified
- Source
- Security updates · open the original at Microsoft
Microsoft's revision notes
- Revision 1.0, 2026-07-02:
Information published.
- Revision 2.0, 2026-09-09:
Updated an acknowledgement. This is an informational change only.
Microsoft says
Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.
What Microsoft changed
One version so far. If Microsoft edits it, each change shows here with what was removed and added.
First version we captured ·
The text as we first saw it
Seen by us · Microsoft's timestamp · Microsoft's page
Related changes
Other changes for Azure OpenAI Service
- Azure OpenAI Elevation of Privilege Vulnerability
- Public preview: Azure Functions extension for OpenAI · In preview
- OpenAI Whisper model in preview in Azure OpenAI service and Azure AI Speech · In preview
- Introducing GPT-4o: OpenAI’s new flagship multimodal model now in preview on Azure · In preview
- Announcing the General Availability of GPT-4 Turbo with Vision on Azure OpenAI Service · Launched
- Public Preview: Azure OpenAI Service On Your Data · In preview
- Azure Machine Learning - Public Preview for July · In preview
- Azure Machine Learning - Public Preview for October · In preview
Last updated