CVE-2026-32213

The vulnerability results from improper implementation of access controls in the Azure AI Foundry service. An attacker operating remotely, without needing to possess an account or permissions, can send an appropriately crafted network request that bypasses authorization mechanisms. As a result, the attacker gains a higher level of access than they are entitled to, which in the context of a cloud environment (Scope: Changed) means potential breach of isolation boundaries between resources.

An unauthorized attacker can obtain elevated privileges in the Azure AI Foundry environment, which according to the CVSS vector leads to complete breach of confidentiality, integrity, and availability of resources. This may include access to third-party data, modification of resources, or disruption of service operations.

Security patches available from the vendor should be applied according to the references: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32213. In the case of services managed by Microsoft (SaaS/PaaS), the update may be deployed automatically on the vendor's side — verification of status in Microsoft Security Response Center is recommended.

Microsoft Azure AI Foundry — versions indicated in vendor references