Microsoft has published a critical security record for its own Azure OpenAI service. CVE-2026-119990, dated November 10, 2026, describes “missing authentication for a critical function in Azure OpenAI” that “allows an unauthorized attacker to elevate privileges over a network.” Microsoft and the National Vulnerability Database both score it 9.8, the top end of the CVSS 3.1 scale: network-reachable, low complexity, no privileges and no user interaction required, with high impact on confidentiality, integrity and availability.
Quick Take
- What it is: A missing-authentication (CWE-306) elevation-of-privilege flaw in the Azure OpenAI service, published on November 10, 2026 as CVE-2026-119990.
- Severity: CVSS 3.1 9.8 (Critical). Microsoft also labels the severity Critical. Exploit code maturity is listed as unproven; Microsoft’s exploit status is “not exploited.”
- Customer action: Microsoft says it has already fully mitigated the vulnerability on the service. “There is no action for users of this service to take.” The CVE exists “to provide further transparency.”
- Affected build: Third-party trackers summarizing the MSRC record list Azure OpenAI builds from 1.0.0 through the fix identified as
hyena-infra-build-official/20260923.14. - Not in CISA KEV: As of the November 10 updates, the CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog, and Microsoft reports no known exploitation.
What happened
Cloud services rarely get classic “install this patch” CVEs, because the vendor can fix the running service without a customer update. Microsoft has been publishing those service-side issues anyway, under a transparency program it has described as “unveiling Cloud Service CVEs.” CVE-2026-119990 is one of those records.
The description is short and severe. Authentication was missing on a “critical function,” and an attacker who could reach that function over the network could elevate privileges, with high impact across confidentiality, integrity and availability. The GitHub Advisory Database entry, imported from NVD, classifies the weakness as CWE-306.
Microsoft updated the “Customer Action Required” text and FAQ on the same day the CVE was published, to make the operational point unambiguous: the company has already mitigated the issue, and customers do not have a patch or configuration step to apply. The purpose of the CVE, Microsoft says, is disclosure, not a call to action.
What we still do not know
Microsoft has not, in the public CVE text, named the exact API, portal feature or control-plane function that lacked authentication, or said how long the condition was present before the September 23, 2026-dated fixed build. It also has not published a technical write-up of the privilege that could have been gained. That is typical of cloud-service CVEs, but it leaves outside observers unable to judge residual risk in logs or custom integrations.
The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a worst-case, unauthenticated, remote path. Whether that path was practically reachable from the public internet, or only in a narrower service-to-service context, is not spelled out in the advisory.
What it means
For Azure OpenAI customers
Microsoft’s position is that no action is required. That is only as reassuring as your trust in the mitigation and in the “not exploited” status. Firms that log Azure activity should still review unusual privilege or identity changes around the disclosure window, not because Microsoft has reported exploitation, but because a 9.8 cloud CVE is the kind of record auditors will ask about.
For security teams
Treat this as a reminder that “we patched the service for you” still belongs in a vulnerability register. Record the CVE, the vendor statement, and the date. If you run other Azure AI services, watch the MSRC update guide for related cloud CVEs rather than waiting for a VM patch Tuesday bulletin.
For the industry
A 9.8 on a hosted model API, even when already fixed, is a signal of how much privilege now sits behind a single cloud function. Missing authentication on that class of service is not a theoretical bug class; it is one of the highest-impact failures a cloud AI platform can have.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This i10x report is based on Microsoft’s MSRC entry for CVE-2026-119990, the NVD record, and the GitHub Advisory Database entry as of November 11, 2026. i10x did not independently verify the internal Azure OpenAI function that was affected.
