Microsoft's Security Update Guide published it on 22 October 2026 at 07:00 US Pacific time (14:00 UTC; 10:00 pm Perth) CVE-2026-108456, 'Azure AI Foundry Elevation of Privilege Vulnerability': server-side request forgery (CWE-918) in Azure AI Foundry allows an authorised attacker to elevate privileges over a network. Microsoft rates it Critical with a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).

Microsoft's FAQ says the vulnerability has already been fully mitigated by Microsoft, there is no action for users of the service to take, and the CVE is published to provide further transparency.

Microsoft lists it as not publicly disclosed and not exploited. It was one of six Microsoft cloud-service CVEs published that day; the others are on their own desk cards. Primary: Microsoft Security Response Center; CVE record.