Missing Authentication for Critical Function - CVE-2026-119990
Published: November 11, 2026 / Updated: November 11, 2026
Vulnerability identifier: #VU165427
CSH Severity: Low
CVSS v4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-119990
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to escalate privileges in Azure OpenAI.
The vulnerability exists due to missing authentication for a critical function in Azure OpenAI when handling network requests. A remote attacker can invoke the critical function without authentication to escalate privileges, potentially accessing or modifying sensitive information and disrupting service availability.
Note, this vulnerability is present in Microsoft cloud solution and therefore does not have own security bulletin.
How to mitigate CVE-2026-119990
Install security update from vendor's website.