CVE-2026-119990criticalBroken access control2026-11-10

CVE-2026-119990: Azure OpenAI missing-authentication flaw rated 9.8, fixed by Microsoft in the service

Microsoft disclosed a critical elevation-of-privilege bug in Azure OpenAI caused by missing authentication for a critical function, reachable over the network with no login. Microsoft marks it as not publicly disclosed, not exploited, and needing no customer action, because the fix was made in the cloud service itself.

01.

What it is

Microsoft's description: missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.

The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact (9.8).

Microsoft published it on 10 November 2026 and lists it as not publicly disclosed and not exploited. It gives no further technical detail.

02.

How to check

Nothing to patch: Microsoft says no customer action is required for this CVE.
If you want extra assurance, review Azure activity logs and key usage for your Azure OpenAI resources for anything you don't recognise.

03.

How to fix

No action needed for this CVE; it was fixed on Microsoft's side.
As general hygiene, prefer Microsoft Entra ID auth over API keys for Azure OpenAI and rotate any keys you suspect were exposed.

04.

Sources

More advisories for this tool