CVE-2026-119990

An Azure OpenAI service function lacked authentication

Microsoft · Azure OpenAI managed service

First documented disclosure · Review checkpoint

Summary

A critical service operation failed to authenticate the caller. An unauthenticated caller could elevate privileges in the service.

Severity and exploitation evidence

Critical · 9.8/10 · CVSS 3.1. Severity source.

Exploitation not established: Microsoft marked exploitation as No at publication.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A critical service operation failed to authenticate the caller.

Conditions required

The affected Microsoft-managed service was reachable over the network.

Potential impact

An unauthenticated caller could elevate privileges in the service.

Affected versions and configurations

Microsoft identifies its pre-mitigation Azure OpenAI service deployment.

Fix and mitigation status

Microsoft confirms full service-side mitigation. No customer update is required.

Practical next steps

Microsoft completed the correction on the service.

Operating lesson

Track the deployed SDK, extension or managed service when applying Microsoft’s remediation.

Evidence and limits

The CVE record was published on 2026-11-10.

Sources