Cyber Resilience

CVE-2026-32169

Critical

Published: 19 March 2026

Published
19 March 2026
Modified
14 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0055 41.7th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-32169 is a critical-severity SSRF (CWE-918) vulnerability in Microsoft Azure Cloud Shell. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-32169 is a server-side request forgery (SSRF) vulnerability, mapped to CWE-918, affecting Azure Cloud Shell. Published on 2026-03-19T21:17:10.233, it carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), marking it as critically severe due to its network accessibility, low attack complexity, lack of required privileges or user interaction, scope change, and high impacts on confidentiality, integrity, and availability.

An unauthorized attacker can exploit this SSRF vulnerability remotely over the network without prior privileges. Successful exploitation enables privilege elevation, potentially allowing the attacker to gain unauthorized access to higher-level resources or perform actions beyond their intended scope within the Azure Cloud Shell environment.

The Microsoft Security Response Center advisory provides details on mitigation and patches at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32169.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a network.

CWE(s)
CWE-918

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

SSRF vulnerability in public-facing Azure Cloud Shell directly enables exploitation of a public-facing application (T1190) and facilitates privilege escalation (T1068) as stated in the description.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-35428Same product: Microsoft Azure Cloud Shell
CVE-2025-21177Same vendor: Microsoft
CVE-2025-59503Same vendor: Microsoft
CVE-2025-62207Same vendor: Microsoft
CVE-2026-26138Same vendor: Microsoft
CVE-2026-32186Same vendor: Microsoft
CVE-2026-26137Same vendor: Microsoft
CVE-2026-33107Same vendor: Microsoft
CVE-2026-26150Same vendor: Microsoft
CVE-2026-41105Same vendor: Microsoft

Affected Assets

microsoft
azure cloud shell
all versions

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates SSRF by validating and sanitizing user-supplied inputs in Azure Cloud Shell that could forge unauthorized server-side requests.

SI-9 Information Input Restrictions good match
prevent

Restricts Cloud Shell inputs to approved sources or formats, such as URL allowlists, preventing attackers from directing server requests to unauthorized internal resources.

AC-4 Information Flow Enforcement good match
prevent

Enforces information flow policies to block unauthorized network requests from the Cloud Shell server to internal systems during SSRF exploitation.

References