Quick Look: Azure OpenAI CVE-2026-119990, a Critical Missing-Authentication Privilege Escalation Mitigated by Microsoft

Introduction

Microsoft has disclosed a critical flaw in Azure OpenAI where a critical function ran without checking who was calling it, letting an unauthenticated attacker on the network elevate privileges against the service. The bug carries a CVSS v3.1 base score of 9.8. It lived entirely in Microsoft's hosted infrastructure, and Microsoft says it is already fully mitigated, so the useful questions for defenders concern exposure history and log review rather than patch deployment.

This post summarizes what the advisory and supporting sources establish about CVE-2026-119990, and what they do not.

Technical information

Root cause

Microsoft's description is short: "Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network." The assigned weakness is CWE-306, Missing Authentication for Critical Function. MITRE defines this as a product failing to authenticate functionality that requires a provable user identity or consumes a significant amount of resources.

In practical terms, some operation inside the Azure OpenAI service accepted and processed requests without first establishing the caller's identity. A fix for this class of bug normally places an authentication requirement in front of the function, so that a request with no identity is rejected rather than processed. Microsoft has not said which function or endpoint was affected or how the new check works. The logic is closed source, so there is no public commit, diff, or code snippet to examine.

Scoring breakdown

Microsoft, acting as the CNA, published the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• AV:N, AC:L, PR:N, UI:N: reachable over the network, low complexity, no privileges required, no user interaction. Although the issue is labeled elevation of privilege, the attacker does not need to be authenticated already.
• S:U, C:H, I:H, A:H: scope unchanged, with High impact to confidentiality, integrity and availability.
• E:U, RL:O, RC:C: exploit maturity Unproven, remediation level Official Fix, report confidence Confirmed. These temporal metrics bring the score from the 9.8 base down to an 8.5 temporal score. The drop reflects remediation status, not a change in how serious the underlying bug was.

NVD lists the record as awaiting enrichment. The 9.8 shown on NVD is Microsoft's CNA score, not an independent NVD assessment.

Attack flow

Based on the CVSS vector and ZDI's summary of Microsoft's FAQ, the attack as described looks like this:

1. An unauthenticated attacker with network access to an affected Azure OpenAI service sends a crafted request over the internet.
2. The targeted critical function processes the request without verifying the caller's identity (the CWE-306 condition).
3. The attacker gains elevated privileges relative to their unauthenticated starting point.
4. According to ZDI's summary, the resulting impact is access to orchestration information, changes to workflows, or disruption of the service.

What the disclosure does not establish

The records do not identify a vulnerable API path, request structure, authentication component, the specific role gained, or a reproducible exploitation sequence. The High impact ratings do not document any observed data theft or outage, and Scope Unchanged does not describe a tenant boundary. Nothing in the published material supports claims of subscription administrator access, cross-tenant compromise, arbitrary code execution, or model manipulation. We are keeping the classification at what Microsoft documented: unauthenticated network privilege elevation.

Patch information

Microsoft fixed CVE-2026-119990 inside the Azure OpenAI service itself. There is nothing to download or install. The MSRC advisory, published November 10, 2026, says the issue "requires no customer action to resolve." Its FAQ adds that the vulnerability "has already been fully mitigated by Microsoft" and that the CVE exists "to provide further transparency." It was released under Microsoft's cloud service CVE program, which publishes CVEs for flaws in Microsoft-hosted services even when customers do not need to do anything.

Reading the fixed version

Cloud services do not have version numbers like installed software, so Microsoft identifies the fix by an internal deployment build:

Fixed build:    hyena-infra-build-official/20260923.14
Affected range: 1.0.0 < hyena-infra-build-official/20260923.14

• The fixed build appears in the advisory's Security Updates table for the product "Azure Open AI," next to "Release Notes" and "Security Update" links, with an Impact of Elevation of Privilege and Severity of Critical.
• The CVE record, as shown on NVD, lists everything from 1.0.0 up to but not including that build as affected. In practice, every service build before it lacked the authentication check.
• NVD labels the record "Exclusively Hosted Service," confirming the vulnerable code ran only on Microsoft's infrastructure and customers never ran it themselves.
• Our inference: the build string appears to contain a date, 2026/09/23. If so, the fix was built roughly seven weeks before the November 10 disclosure and was likely live before the CVE became public. Microsoft does not state this, so treat it as an estimate.

Advisory revisions and a conflicting report

The advisory was revised on its publication day:

• v1.0 (Nov 10, 2026): Information published.
• v1.1 (Nov 10, 2026): Microsoft updated the "Customer Action Required" field and the FAQ to clarify that it had fully mitigated the vulnerability and no customer action is required.

Some third-party Patch Tuesday writeups appear to rely on v1.0. Action1's November 2026 digest, for example, says Microsoft "lists customer action as required" and tells teams to follow the Azure OpenAI release notes. StackFlag similarly recommends updating Azure Open AI to the listed build. Revision 1.1 replaces that position, so the current MSRC advisory is the source to trust. Upwind, IONIX, and CrowdStrike all report the fix as applied by Microsoft on the service side, and Upwind and IONIX cite the same fixed build string.

General hardening (not a CVE workaround)

Microsoft's Azure security baseline for Azure OpenAI recommends:

• deny-by-default network access with private endpoints
• restricting local authentication methods in favor of Microsoft identity authentication for data plane access
• managed identities instead of service principals where possible
• access scoped with Azure RBAC
• resource logs sent to a storage account or Log Analytics workspace

These are reasonable ongoing controls, and the baseline itself notes some guidance may be outdated. None of them is documented as a workaround or fix for CVE-2026-119990, and they should not be presented to stakeholders as an emergency remediation.

Detection methods

We found no public detection content tailored to CVE-2026-119990. There are no Sigma, YARA, Snort/Suricata, or KQL/SPL rules for it, and no published IoCs. The only defensive guidance available is general log review advice.

Why there are no signatures

The vulnerable code runs inside Microsoft's managed service, so customers have nothing to scan, hash, or match a file signature against. Microsoft rated exploit maturity as Unproven, and ZDI's table shows the issue as not publicly disclosed and not exploited. Without public exploit traffic, vendors had nothing to build network signatures from. Talos published Snort 2 and Snort 3 rule coverage for November 2026 Patch Tuesday, but did not link any of those rule IDs to this CVE, so do not assume your IDS/IPS ruleset covers it.

Confirm the advisory status first

Microsoft first marked the advisory "Customer Action Required: Yes" without saying what customers should do, then revised it to say no action is needed. AI Sec Watch and Upwind both report the issue as fully mitigated. Before starting any hunt, confirm on the MSRC advisory page that you are looking at the revised status. The build string hyena-infra-build-official/20260923.14 is a backend service version. Customers do not deploy it and cannot query it.

Retrospective hunting

The only published monitoring advice comes from IONIX, which suggests reviewing access logs for unexpected unauthenticated activity against Azure OpenAI endpoints. Based on the attack description, a reasonable hunt has three parts:

• Inventory your Azure OpenAI resources and note which were reachable from the public internet, as opposed to restricted to private endpoints or IP allow lists. Prioritize those exposed resources, since exposure is what made the attack possible.
• In resource request and diagnostic logs, look for calls that succeeded without a valid caller identity or key, and for unfamiliar source IPs. Focus on activity before Microsoft's fix.
• Look for signs of the impacts in Microsoft's FAQ as summarized by ZDI: unexplained reads of orchestration or configuration data, unauthorized workflow or deployment changes, and unexplained service disruptions.

None of the sources publish specific log fields, query syntax, request paths, or attacker infrastructure, so any query you write is a behavioral hunt rather than a signature match. Because exploitation was never confirmed and the fix was applied on Microsoft's side, unusual results are leads to investigate, not proof of compromise.

Affected systems and versions

• Vendor: Microsoft
• Product: Azure Open AI (Azure OpenAI Service)
• Affected range: service builds from 1.0.0 up to but not including hyena-infra-build-official/20260923.14
• Fixed build: hyena-infra-build-official/20260923.14, deployed by Microsoft
• Deployment type: Exclusively Hosted Service per NVD, with no customer-installed components and no customer configuration documented as a precondition
• Advisory dates: published November 10, 2026 by MSRC; NVD last modified November 11, 2026
• Exploitation status at publication: not publicly disclosed, not exploited, exploitability assessment N/A; finder credited as Anonymous

Singapore's Cyber Security Agency also lists the CVE with a 9.8 score in its November 2026 monthly advisory, without additional exploitation detail.

Vendor security history

The most relevant historical case for Microsoft cloud identity security is the 2023 Exchange Online intrusion, which is separate from and unrelated to this Azure OpenAI flaw. The Cyber Safety Review Board attributed that intrusion to a threat actor with ties to the People's Republic of China, which compromised mailboxes including accounts associated with senior United States government officials. The Board concluded the intrusion should never have happened, attributed it to a cascade of Microsoft security failures, found Microsoft's security culture inadequate, and recommended modern identity controls and default audit logging for cloud providers.

Since then, Microsoft's July 2026 Secure Future Initiative report claims 99.97 percent user and device coverage for phishing-resistant MFA, removal of public access from 732,000 resources, and standardized critical security logging from over 81 percent of services. These are vendor-reported program metrics, not an independent audit, and the report itself says security requires continuous validation and reevaluation. A newly disclosed authentication flaw in a hosted service is consistent with that caveat.

For scale, Synergy Research (via Data Center Dynamics) estimates Microsoft held 19 percent of the global cloud market in Q3 2026, with Google behind it at 16 percent. That is a broad cloud figure, not Azure OpenAI share, and it says nothing about how many customers this CVE affected. Our read is that the broader record supports continued attention to access controls and log availability, rather than either blanket confidence or blanket distrust.

References

• NVD entry for CVE-2026-119990
• CVE Record for CVE-2026-119990
• Microsoft Security Update Guide: Azure OpenAI Elevation of Privilege Vulnerability
• Upwind: Azure OpenAI missing auth for critical function enables remote privilege elevation
• Upwind AI Threat Feed
• IONIX Threat Center: CVE-2026-119990
• Action1: Patch Tuesday November 2026
• Zero Day Initiative: The November 2026 Security Update Review
• Cisco Talos: Microsoft Patch Tuesday for November 2026
• AI Sec Watch issues
• CrowdStrike: November 2026 Patch Tuesday Updates and Analysis
• Cyber Security Agency of Singapore: November 2026 Monthly Patch
• StackFlag: CVE-2026-119990 Azure OpenAI
• MITRE CWE-306: Missing Authentication for Critical Function
• Microsoft Learn: Azure security baseline for Azure OpenAI
• Microsoft Azure Blog: General availability of Azure OpenAI Service
• Microsoft Trust Center: SFI Progress Report July 2026
• CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Data Center Dynamics: Synergy enterprise cloud infrastructure spending Q3
• CRN: Cloud Market Share Q3