Azure AI Foundry: Microsoft fixes a request forgery flaw server side
CVE-2026-108456 is a server-side request forgery flaw in Azure AI Foundry that Microsoft says it has already fixed in the service.
· Microsoft · Research by Microsoft Security Response Center
Microsoft published CVE-2026-108456 on 22 October 2026, a server-side request forgery flaw in Azure AI Foundry that it scores 7.7. Microsoft states the hosted service is already fully mitigated and that customers need take no action.
01What happened
Microsoft disclosed CVE-2026-108456 in its 2026-Oct security update release on 22 October 2026, naming Azure AI Foundry, its platform for building and hosting AI applications. Microsoft is the assigning authority for the record and reports that the flaw was neither publicly disclosed nor exploited before the advisory. No outside researcher is named.
02How it works
Microsoft classes the weakness as CWE-918, server-side request forgery, and describes the effect as allowing an authorized attacker to elevate privileges over a network. The published vector, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, describes a caller who already holds low privileges and needs no user interaction, with high impact on confidentiality, none on integrity or availability, and a change of scope. Microsoft publishes no further technical detail, so the request path and the endpoints it could reach are not described.
03Who is affected
Azure AI Foundry is the only product named, and the advisory lists no affected or patched version numbers because the service is hosted by Microsoft. Microsoft's own severity label on the record reads Critical even though the CVSS base score it publishes is 7.7, with a temporal score of 6.7.
04What to do
No customer action is required, because the advisory's FAQ states the flaw has already been fully mitigated by Microsoft. Treat this record as an inventory note for teams that track Azure AI Foundry, not as patching work.
Sources 2 links, all fetched
- 1msrc.microsoft.comMicrosoft Advisory
- 2github.comGitHub Advisory