CVE-2026-119990

Summary

A critical missing authentication vulnerability (CWE-306) in Azure OpenAI allows unauthenticated remote attackers to perform privileged operations over the network. This enables full compromise of confidentiality, integrity, and availability due to the lack of any access control on a sensitive function.

Exploitability

Exploitation is trivial for any remote attacker with network access, requiring no authentication, privileges, or user interaction.

Blast radius

Successful exploitation could allow attackers to fully compromise Azure OpenAI resources, including unauthorized model access, data exfiltration, service disruption, or lateral movement within the cloud environment.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Microsoft has not published a fixed version in the description; apply immediate network-level restrictions to the affected Azure OpenAI endpoint(s), enforce strict IP allowlisting, and disable public access until authentication is properly implemented per vendor guidance.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.