External risk intelligence

Azure OpenAI Privilege Escalation via Missing Authentication

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-119990

Azure OpenAI services are designed as cloud-based, public-facing API endpoints used for generative AI applications. They are inherently intended to be accessible over the internet to authorized consumers, making the service's interface a public-facing component by design.

Missing Authentication

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Azure OpenAI, allowing unauthorized network access to elevate privileges. This issue affects the authentication mechanism for a core function within the service. The potential for privilege escalation demands attention to confirm its applicability to our environment and assess any exposure.

Unauthorized access can escalate system privileges.
Core Azure OpenAI function has a critical flaw.
Confirm relevance and potential exposure to our systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests over the network to an exposed Azure OpenAI endpoint. This could allow them to bypass authentication controls, leading to unauthorized privilege escalation within the service. The full extent of what an attacker could do with elevated privileges is not detailed, but it could potentially impact the confidentiality, integrity, and availability of data processed by the service.

No authentication required to reach.
Bypasses authentication for a critical function.
Allows unauthorized privilege escalation.

Live Threat

Current exploitation, exposure, and threat context

An unauthorized attacker could exploit a missing authentication mechanism in Azure OpenAI services to gain elevated privileges. This could potentially affect the service's behavior and allow unauthorized actions when accessed over a network.

Service behavior and control at risk.
Via unauthenticated network access.
Unauthorized privilege escalation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Azure OpenAI requires immediate attention from platform and security teams. The first practical step is to identify all instances of Azure OpenAI within your environment, confirm their network reachability and business criticality, and then identify the accountable owner for each instance to plan a risk-based remediation strategy.

Platform and Security teams own this issue.
Verify Azure OpenAI instance reachability and criticality.
Plan coordinated remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Azure OpenAI?

Azure OpenAI is a managed cloud service providing access to advanced generative AI models, such as GPT and DALL-E, via API endpoints. Organizations use it to integrate AI capabilities into their applications, relying on the platform to handle backend infrastructure, scalability, and security for high-performance machine learning tasks.

What does CWE-306 mean for CVE-2026-119990?

CWE-306 refers to Missing Authentication for Critical Function. In the context of this vulnerability, it means the software fails to verify the identity of a user or system before performing sensitive operations. Consequently, an attacker can invoke restricted functions without providing valid credentials, which this specific flaw allows for privilege escalation.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specially crafted network requests directly to the Azure OpenAI endpoint. This does not require any prior access or stolen credentials, as the system incorrectly permits these requests to proceed without authentication. Conversely, local or offline operations that do not communicate through the vulnerable API path are not subject to this specific trigger.

Is my Azure OpenAI instance at risk?

Because Azure OpenAI services are typically designed as public-facing API endpoints, Halo Surface Signal identifies them as highly likely to be reachable over the internet. If your instances are configured for network access, they are effectively exposed to this vulnerability, as the flaw bypasses the necessary authentication barriers designed to protect the service.

What should I do first to address this?

Begin by creating a comprehensive inventory of all Azure OpenAI instances currently running in your environment. Once identified, verify which instances are accessible over the network and determine their business function. Finally, contact the designated system owners for each instance to coordinate a risk-based remediation plan.

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-119990

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.