CVE-2026-45499: SSRF flaw enables privilege

CISO Take

Microsoft disclosed a server-side request forgery (SSRF) flaw in Azure OpenAI that lets an already-authenticated attacker with low privileges escalate their access across the service's trust boundary, reaching a CVSS score of 9.9 with confidentiality, integrity, and availability all rated High and a scope change indicating impact beyond the attacker's own tenant. This matters because Azure OpenAI underpins production LLM API integrations, RAG pipelines, and agent workflows across thousands of enterprises, so any cross-tenant or backend-access flaw in the platform has an outsized blast radius even though EPSS puts real-world exploitation likelihood at only 0.62% (top 55th percentile) and there is no public PoC, Nuclei template, or CISA KEV listing. As with most vulnerabilities disclosed against a first-party cloud service, Microsoft remediates the backend before publication, so there is no customer-deployable patch — the concrete action for security teams is to confirm the fix applied via the Azure Security Advisories blade, review Azure Activity Logs and Microsoft Defender for Cloud alerts for anomalous internal requests during the exposure window, and validate least-privilege RBAC scoping on any Azure OpenAI resources tied to authorized low-privilege accounts.

Sources: NVD EPSS CISA KEV ATLAS microsoft.com

What is the risk?

Severity is critical (CVSS 9.9) driven by the scope change (S:C) and full CIA impact, meaning a low-privileged authenticated attacker could pivot beyond their authorization boundary. However, actual exploitation risk is currently low: EPSS sits at 0.62% (top 55th percentile), there is no public exploit code, no Nuclei template, and it is absent from CISA KEV. Because Azure OpenAI is a Microsoft-operated PaaS, the vulnerability class (CWE-918 SSRF) was almost certainly remediated server-side before disclosure, meaning residual customer risk is largely retrospective (has my tenant been affected) rather than prospective (do I need to patch anything).

How does the attack unfold?

Initial Access

Attacker obtains or already holds low-privilege authenticated access to an Azure OpenAI resource (API key or scoped role).

AML.T0012

Exploitation

Attacker sends a crafted network request that triggers the SSRF condition in the Azure OpenAI service backend.

AML.T0049

Privilege Escalation

The scope change inherent to the vulnerability lets the attacker's request reach resources or tenants beyond their original authorization boundary.

Impact

Attacker achieves high-confidentiality, integrity, and availability impact, potentially exposing internal Azure infrastructure or other tenants' data.

Initial Access

Attacker obtains or already holds low-privilege authenticated access to an Azure OpenAI resource (API key or scoped role).

AML.T0012

Exploitation

Attacker sends a crafted network request that triggers the SSRF condition in the Azure OpenAI service backend.

AML.T0049

Privilege Escalation

The scope change inherent to the vulnerability lets the attacker's request reach resources or tenants beyond their original authorization boundary.

Impact

Attacker achieves high-confidentiality, integrity, and availability impact, potentially exposing internal Azure infrastructure or other tenants' data.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.8%

chance of exploitation in 30 days

Higher than 53% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

There is no customer-installable patch since this is a first-party Microsoft cloud service — Microsoft's own remediation is the primary fix. CISOs should: (1) confirm via the Azure Security Advisories / Service Health blade that the fix has been applied to their region/resource; (2) review Azure Activity Logs and Microsoft Defender for Cloud for anomalous outbound or internal-network request patterns on Azure OpenAI resources around the disclosure window (published 2026-07-02); (3) audit RBAC assignments on Azure OpenAI resources to ensure low-privilege roles (PR:L) are scoped as tightly as possible, since the exploit requires only low-privilege authenticated access; (4) where available, enforce Private Link/VNet isolation for Azure OpenAI endpoints to reduce network-reachable attack surface; (5) monitor Microsoft's follow-up guidance for any required customer-side configuration changes.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Privacy Violation API Inference AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Clause 8.2/8.3 - AI risk assessment and risk treatment

NIST AI RMF

MANAGE 2 - AI system risks are monitored and response actions are documented

Frequently Asked Questions

What is CVE-2026-45499?

Microsoft disclosed a server-side request forgery (SSRF) flaw in Azure OpenAI that lets an already-authenticated attacker with low privileges escalate their access across the service's trust boundary, reaching a CVSS score of 9.9 with confidentiality, integrity, and availability all rated High and a scope change indicating impact beyond the attacker's own tenant. This matters because Azure OpenAI underpins production LLM API integrations, RAG pipelines, and agent workflows across thousands of enterprises, so any cross-tenant or backend-access flaw in the platform has an outsized blast radius even though EPSS puts real-world exploitation likelihood at only 0.62% (top 55th percentile) and there is no public PoC, Nuclei template, or CISA KEV listing. As with most vulnerabilities disclosed against a first-party cloud service, Microsoft remediates the backend before publication, so there is no customer-deployable patch — the concrete action for security teams is to confirm the fix applied via the Azure Security Advisories blade, review Azure Activity Logs and Microsoft Defender for Cloud alerts for anomalous internal requests during the exposure window, and validate least-privilege RBAC scoping on any Azure OpenAI resources tied to authorized low-privilege accounts.

Is CVE-2026-45499 actively exploited?

No confirmed active exploitation of CVE-2026-45499 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-45499?

There is no customer-installable patch since this is a first-party Microsoft cloud service — Microsoft's own remediation is the primary fix. CISOs should: (1) confirm via the Azure Security Advisories / Service Health blade that the fix has been applied to their region/resource; (2) review Azure Activity Logs and Microsoft Defender for Cloud for anomalous outbound or internal-network request patterns on Azure OpenAI resources around the disclosure window (published 2026-07-02); (3) audit RBAC assignments on Azure OpenAI resources to ensure low-privilege roles (PR:L) are scoped as tightly as possible, since the exploit requires only low-privilege authenticated access; (4) where available, enforce Private Link/VNet isolation for Azure OpenAI endpoints to reduce network-reachable attack surface; (5) monitor Microsoft's follow-up guidance for any required customer-side configuration changes.

What systems are affected by CVE-2026-45499?

This vulnerability affects the following AI/ML architecture patterns: LLM API / model serving (Azure OpenAI), RAG pipelines built on Azure OpenAI, Agent frameworks invoking Azure OpenAI as a backend, Multi-tenant cloud AI platforms.

What is the CVSS score for CVE-2026-45499?

CVE-2026-45499 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.78%.

What is the AI security impact?

Affected AI Architectures

LLM API / model serving (Azure OpenAI)RAG pipelines built on Azure OpenAIAgent frameworks invoking Azure OpenAI as a backendMulti-tenant cloud AI platforms

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Clause 8.2/8.3

NIST AI RMF: MANAGE 2

What are the technical details?

Original Advisory

Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network.

Exploitation Scenario

An attacker who has obtained low-privilege authenticated access to an Azure OpenAI resource — for example via a leaked API key, a compromised low-privilege service principal, or a legitimately provisioned but restricted account — crafts a network request designed to trigger the SSRF condition in the Azure OpenAI service backend. The service, exploited via CWE-918, is coerced into making requests on the attacker's behalf against internal or cross-boundary targets. Because the vulnerability changes scope (S:C), the attacker's resulting access exceeds their original authorization, potentially reaching internal Azure control-plane resources, metadata services, or data belonging to other tenants, resulting in full confidentiality, integrity, and availability compromise within that expanded scope.

Weaknesses (CWE)

CWE-918 Server-Side Request Forgery (SSRF) Primary CWE-918 Server-Side Request Forgery (SSRF)

CWE-918 — Server-Side Request Forgery (SSRF): The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Source: MITRE CWE corpus.