CVE-2026-119990: Azure OpenAI: missing authentication allows privilege escalation

CRITICAL

Published November 10, 2026

CISO Take

CVE-2026-119990 is a missing-authentication flaw (CWE-306) in a critical function of Azure OpenAI that lets an unauthenticated remote attacker elevate privileges over the network. It is scored CVSS 9.8, requires no privileges or user interaction, and has low attack complexity, so exploitation would be trivial if the vulnerable function is reachable. There is currently no sign of active exploitation: it is not in CISA KEV, no public exploit or Nuclei template is known, and EPSS and SSVC data are not yet available. Blast radius is hard to size because the advisory lists no affected products or versions, and the Microsoft MSRC entry is the only reference. Read the MSRC advisory now to find out whether the fix is applied by Microsoft on the service side or needs customer action. Meanwhile, review Azure OpenAI resource exposure, restrict access with private endpoints and network rules, and audit role assignments and activity logs for unexpected privilege changes.

Sources:NVDATLASmsrc.microsoft.com

What is the risk?

Severity is critical on paper (CVSS 9.8, network-reachable, no authentication, no user interaction, high confidentiality, integrity and availability impact). Real-world risk is uncertain because the data is thin: EPSS is unscored, there is no KEV listing, no public exploit and no scanner template. Azure OpenAI is a managed service, so Microsoft may have remediated it server-side, which would reduce customer exposure. Until the MSRC advisory confirms that, treat the risk as high for any tenant with internet-reachable Azure OpenAI endpoints holding sensitive prompts, fine-tuned models, or connected data sources.

How does the attack unfold?

Initial Access

Attacker reaches the exposed Azure OpenAI endpoint over the network and calls the critical function that requires no authentication.

AML.T0049

Privilege Escalation

The missing authentication check grants elevated privileges on the AI service resource without valid credentials.

Collection

Attacker accesses deployments, keys, or connected data sources and queries models for sensitive data.

AML.T0085

Impact

Data is exposed or exfiltrated, model or safety configuration is tampered with, or the service is abused or disrupted.

Initial Access

Attacker reaches the exposed Azure OpenAI endpoint over the network and calls the critical function that requires no authentication.

AML.T0049

Privilege Escalation

The missing authentication check grants elevated privileges on the AI service resource without valid credentials.

Collection

Attacker accesses deployments, keys, or connected data sources and queries models for sensitive data.

AML.T0085

Impact

Data is exposed or exfiltrated, model or safety configuration is tampered with, or the service is abused or disrupted.

How severe is it?

CVSS 3.1

9.8 / 10

EPSS

0.9%

chance of exploitation in 30 days

Higher than 61% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Review the MSRC advisory (CVE-2026-119990) to see whether the fix is applied by Microsoft automatically or needs customer action, and apply any listed update or configuration change. 2) Reduce exposure: use private endpoints, disable public network access where possible, and apply firewall and virtual network rules to Azure OpenAI resources. 3) Enforce Entra ID authentication, disable local key authentication where feasible, and rotate API keys. 4) Review RBAC role assignments and remove unnecessary Contributor or Owner rights. 5) Detection: monitor Azure Activity Logs and diagnostic logs for unauthenticated or anomalous management operations, unexpected role or key changes, new deployments, and unusual token consumption. 6) Alert on spikes in requests from unfamiliar IP ranges.

How is it classified?

Auth BypassData LeakageAPIInferenceAML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application AML.T0085- Data from AI Services

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Procedures to respond to and recover from previously unknown risks

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-119990?

Is CVE-2026-119990 actively exploited?

No confirmed active exploitation of CVE-2026-119990 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-119990?

1) Review the MSRC advisory (CVE-2026-119990) to see whether the fix is applied by Microsoft automatically or needs customer action, and apply any listed update or configuration change. 2) Reduce exposure: use private endpoints, disable public network access where possible, and apply firewall and virtual network rules to Azure OpenAI resources. 3) Enforce Entra ID authentication, disable local key authentication where feasible, and rotate API keys. 4) Review RBAC role assignments and remove unnecessary Contributor or Owner rights. 5) Detection: monitor Azure Activity Logs and diagnostic logs for unauthenticated or anomalous management operations, unexpected role or key changes, new deployments, and unusual token consumption. 6) Alert on spikes in requests from unfamiliar IP ranges.

What systems are affected by CVE-2026-119990?

This vulnerability affects the following AI/ML architecture patterns: LLM API services, Managed model serving, RAG pipelines, Enterprise copilots and chatbots, Agent frameworks.

What is the CVSS score for CVE-2026-119990?

CVE-2026-119990 has a CVSS v3.1 base score of 9.8 (CRITICAL). The EPSS exploitation probability is 0.92%.

What is the AI security impact?

Affected AI Architectures

LLM API servicesManaged model servingRAG pipelinesEnterprise copilots and chatbotsAgent frameworks

MITRE ATLAS Techniques

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

AML.T0085Data from AI Services

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.

Exploitation Scenario

An attacker scans for exposed Azure OpenAI endpoints and sends crafted network requests to the unauthenticated critical function. This grants elevated privileges on the resource without any credentials. The attacker then lists deployments, retrieves keys or connected data source details, and queries the models to pull sensitive corporate data from RAG-connected stores. They may also alter deployment or content filter settings, or run large volumes of inference to drive up cost or deny service to legitimate applications.

Weaknesses (CWE)

CWE-306Missing Authentication for Critical FunctionalityPrimary CWE-306Missing Authentication for Critical Functionality

CWE-306 — Missing Authentication for Critical Functionality: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.