Cyber Posture

CVE-2026-32186

Critical

Published: 03 April 2026

Published
03 April 2026
Modified
13 April 2026
KEV Added
Patch
CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0006 19.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-32186 is a critical-severity SSRF (CWE-918) vulnerability in Microsoft Bing. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the SSRF vulnerability by requiring identification, reporting, correction, and verification of the specific flaw in Microsoft Bing.

prevent

Enforces validation of inputs such as URLs to prevent attackers from forging server-side requests leading to privilege escalation.

preventdetect

Monitors and controls network communications at boundaries to block or detect unauthorized outbound requests exploited in this SSRF.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

SSRF in public-facing Bing service is remotely exploitable without auth (T1190); description explicitly states resulting privilege elevation and infrastructure compromise (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a network.

Deeper analysisAI

CVE-2026-32186 is a server-side request forgery (SSRF) vulnerability, mapped to CWE-918, affecting Microsoft Bing. Published on 2026-04-03T18:16:24.993, it carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), marking it as critically severe due to its potential for high-impact confidentiality, integrity, and availability effects across a scoped attack surface.

The vulnerability enables an unauthorized attacker to exploit it remotely over a network with low attack complexity, requiring no privileges, user interaction, or special conditions. Successful exploitation allows the attacker to elevate privileges, potentially compromising the targeted Bing infrastructure.

Microsoft's Security Response Center has published an update guide detailing mitigation and patching information at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32186. Security practitioners should consult this advisory for specific remediation steps.

Details

CWE(s)

Affected Products

microsoft
bing
all versions

CVEs Like This One

CVE-2026-26120Same product: Microsoft Bing
CVE-2026-33819Same product: Microsoft Bing
CVE-2025-21355Same product: Microsoft Bing
CVE-2025-21177Same vendor: Microsoft
CVE-2026-32169Same vendor: Microsoft
CVE-2025-59503Same vendor: Microsoft
CVE-2026-26138Same vendor: Microsoft
CVE-2026-26137Same vendor: Microsoft
CVE-2026-26150Same vendor: Microsoft
CVE-2025-62207Same vendor: Microsoft

References