CVE-2026-26135
This vulnerability is a server‑side request forgery (SSRF) in Microsoft Azure Custom Locations Resource Provider. It allows an attacker who already has some level of authorization to send requests to internal network services, effectively giving them elevated privileges. The flaw can be exploited remotely with minimal effort.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Microsoft Azure Custom Locations Resource Provider (any version).
Real-world impact
An attacker could use the SSRF to reach internal Azure services, read or modify sensitive data, or move laterally within the Azure environment, potentially compromising other resources.
Why this severity
The CVSS score of 9.6 reflects that the attack can be performed over the network (AV:N), requires low attack complexity (AC:L) and low privileges (PR:L), needs no user interaction (UI:N), and changes the scope of the affected component (S:C). The impact on confidentiality and integrity is high (C:H, I:H), while availability is not affected (A:N).
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Apr 3, 2026 · Apr 3, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 24, 2026 · 11d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- msrc.microsoft.com/update-guide/vulnerability/…vendor advisory