8.8
CVE-2026-26118
- EPSS 0.05%
- Veröffentlicht 10.03.2026 17:05:21
- Zuletzt bearbeitet 13.03.2026 20:12:47
- Quelle secure@microsoft.com
- CVE-Watchlists
- Unerledigt
LoginAzure MCP Server Tools Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Azure Mcp Server Version < 2.0.0
Microsoft ≫ Azure Mcp Server Version2.0.0 Updatebeta1
Microsoft ≫ Azure Mcp Server Version2.0.0 Updatebeta10
Microsoft ≫ Azure Mcp Server Version2.0.0 Updatebeta11
Microsoft ≫ Azure Mcp Server Version2.0.0 Updatebeta12
Microsoft ≫ Azure Mcp Server Version2.0.0 Updatebeta13
Microsoft ≫ Azure Mcp Server Version2.0.0 Updatebeta14
Microsoft ≫ Azure Mcp Server Version2.0.0 Updatebeta15
Microsoft ≫ Azure Mcp Server Version2.0.0 Updatebeta16
Microsoft ≫ Azure Mcp Server Version2.0.0 Updatebeta2
Microsoft ≫ Azure Mcp Server Version2.0.0 Updatebeta3
Microsoft ≫ Azure Mcp Server Version2.0.0 Updatebeta4
Microsoft ≫ Azure Mcp Server Version2.0.0 Updatebeta5
Microsoft ≫ Azure Mcp Server Version2.0.0 Updatebeta6
Microsoft ≫ Azure Mcp Server Version2.0.0 Updatebeta7
Microsoft ≫ Azure Mcp Server Version2.0.0 Updatebeta8
Microsoft ≫ Azure Mcp Server Version2.0.0 Updatebeta9
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.05% | 0.135 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| secure@microsoft.com | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
CWE-918 Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.