CVE-2026-26135
Published: 03 April 2026
Summary
CVE-2026-26135 is a critical-severity SSRF (CWE-918) vulnerability in Microsoft Azure Custom Locations Resource Provider. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 43.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-26135 is a server-side request forgery (SSRF) vulnerability, mapped to CWE-918, in the Azure Custom Locations Resource Provider (RP). Published on 2026-04-03, it carries a CVSS v3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), indicating high severity due to network accessibility, low attack complexity, and changed scope with significant confidentiality and integrity impacts.
An authorized attacker with low privileges (PR:L) can exploit this SSRF vulnerability remotely over the network without user interaction. Exploitation enables privilege elevation, allowing the attacker to gain higher access levels within the affected Azure component.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26135 provides details on patches and mitigation steps.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-18556
Vulnerability details
Server-side request forgery (ssrf) in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in Azure RP allows authenticated low-priv attacker to escalate privileges (CWE-918, PR:L to higher access), directly enabling T1068 Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the SSRF flaw in Azure Custom Locations RP by identifying, reporting, and applying vendor patches to prevent exploitation and privilege escalation.
Validates and sanitizes user inputs to the resource provider to block malicious URLs or parameters that trigger unauthorized server-side requests leading to SSRF.
Monitors and controls network communications at boundaries to filter unauthorized outbound requests from the vulnerable Azure service, mitigating SSRF attempts.