Zero Day MonitorZDM

← Back to list

7.7

CVE-2026-108456PATCHED

Microsoft · Azure AI Foundry

Azure AI Foundry Elevation of Privilege Vulnerability

Description

Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.

Affected Products

Vendor	Product	Versions
Microsoft	Azure AI Foundry	-

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108456(vendor-advisory, patch)

Related News (2 articles)

Tier C

VulDB1d ago

CVE-2026-108456 | Microsoft Azure AI Foundry server-side request forgery

→ No new info (linked only)

Tier A

Microsoft MSRC1d ago

CVE-2026-108456 Azure AI Foundry Elevation of Privilege Vulnerability

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.17.7 HIGH

VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C

CISA KEV❌ No

Actively exploited❌ No

Patch available

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108456

CWECWE-918

PublishedOct 22, 2026

Last enriched1d agov2

Trending Score37

Source articles2

Independent2

Info Completeness9/14

Missing: title, epss, kev, exploit, iocs

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-96951EXPKEV

Windows Shell Security Feature Bypass Vulnerability

CRITICALCVE-2026-105014

Azure Pipelines Remote Code Execution Vulnerability

CRITICALCVE-2026-110063

VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability

HIGHCVE-2026-96185

Microsoft Exchange Online Remote Code Execution Vulnerability

CRITICALCVE-2026-83938

Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability

Pin to Dashboard

Verification

State: verified

Confidence: 0%

Vulnerability Timeline

CVE Published

Oct 22, 2026

Discovered by ZDM

Oct 22, 2026

Updated: description, mitreAttack

Oct 22, 2026

Patch Available

Oct 24, 2026

Version History

v2

Last enriched 1d ago

v2Tier A1d ago

Added vulnerability title, detailed description explaining SSRF mechanism and elevation of privilege impact, and added MITRE ATT&CK technique T1190 (Exploit Public-Facing Application).

descriptionmitreAttack

via Microsoft MSRC

v11d ago

Initial creation