Cyber Posture

CVE-2026-32169

Critical

Published: 19 March 2026

Published
19 March 2026
Modified
14 April 2026
KEV Added
—
Patch
—
CVSS Score 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0010 27.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a network.

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match
prevent

Directly mitigates SSRF by validating and sanitizing user-supplied inputs in Azure Cloud Shell that could forge unauthorized server-side requests.

SI-9 Information Input Restrictions good match
prevent

Restricts Cloud Shell inputs to approved sources or formats, such as URL allowlists, preventing attackers from directing server requests to unauthorized internal resources.

AC-4 Information Flow Enforcement good match
prevent

Enforces information flow policies to block unauthorized network requests from the Cloud Shell server to internal systems during SSRF exploitation.

Security SummaryAI

CVE-2026-32169 is a server-side request forgery (SSRF) vulnerability, mapped to CWE-918, affecting Azure Cloud Shell. Published on 2026-03-19T21:17:10.233, it carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), marking it as critically severe due to its network accessibility, low attack complexity, lack of required privileges or user interaction, scope change, and high impacts on confidentiality, integrity, and availability.

An unauthorized attacker can exploit this SSRF vulnerability remotely over the network without prior privileges. Successful exploitation enables privilege elevation, potentially allowing the attacker to gain unauthorized access to higher-level resources or perform actions beyond their intended scope within the Azure Cloud Shell environment.

The Microsoft Security Response Center advisory provides details on mitigation and patches at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32169.

Details

CWE(s)
CWE-918

Affected Products

microsoft
azure cloud shell
all versions

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

SSRF vulnerability in public-facing Azure Cloud Shell directly enables exploitation of a public-facing application (T1190) and facilitates privilege escalation (T1068) as stated in the description.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References