CVE-2026-32169
Published: 19 March 2026
Summary
CVE-2026-32169 is a critical-severity SSRF (CWE-918) vulnerability in Microsoft Azure Cloud Shell. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates SSRF by validating and sanitizing user-supplied inputs in Azure Cloud Shell that could forge unauthorized server-side requests.
Restricts Cloud Shell inputs to approved sources or formats, such as URL allowlists, preventing attackers from directing server requests to unauthorized internal resources.
Enforces information flow policies to block unauthorized network requests from the Cloud Shell server to internal systems during SSRF exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF vulnerability in public-facing Azure Cloud Shell directly enables exploitation of a public-facing application (T1190) and facilitates privilege escalation (T1068) as stated in the description.
NVD Description
Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a network.
Deeper analysisAI
CVE-2026-32169 is a server-side request forgery (SSRF) vulnerability, mapped to CWE-918, affecting Azure Cloud Shell. Published on 2026-03-19T21:17:10.233, it carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), marking it as critically severe due to its network accessibility, low attack complexity, lack of required privileges or user interaction, scope change, and high impacts on confidentiality, integrity, and availability.
An unauthorized attacker can exploit this SSRF vulnerability remotely over the network without prior privileges. Successful exploitation enables privilege elevation, potentially allowing the attacker to gain unauthorized access to higher-level resources or perform actions beyond their intended scope within the Azure Cloud Shell environment.
The Microsoft Security Response Center advisory provides details on mitigation and patches at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32169.
Details
- CWE(s)