CVE-2026-26118

moderate-risk

Published 2026-03-10

Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.

Do I need to act?

-

0.08% chance of exploitation

EPSS score — low exploit probability

-

Not on CISA KEV list

No confirmed active exploitation reported to CISA

?

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

8

CVSS 8.8/10 High

NETWORK / LOW complexity

Affected Products (17)

Azure Mcp Server

Azure Mcp Server

Azure Mcp Server

Azure Mcp Server

Azure Mcp Server

Azure Mcp Server

Azure Mcp Server

Azure Mcp Server

Azure Mcp Server

Azure Mcp Server

Azure Mcp Server

Azure Mcp Server

Azure Mcp Server

Azure Mcp Server

Azure Mcp Server

Azure Mcp Server

Azure Mcp Server

Affected Vendors

Microsoft

References (1)

Vendor Advisory https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26118

49

/ 100

moderate-risk

Severity 30/34 · Critical

Exploitability 0/34 · Minimal

Exposure 19/34 · Moderate