CVE-2026-26135

CriticalCVSS 9.6

Published: 03/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.60%

45th percentile - higher than 45% of all known CVEs

Summary

A Server-Side Request Forgery (SSRF) vulnerability in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges over a network.

Risk Assessment

An attacker can exploit SSRF to access internal network resources and escalate privileges.

Recommendation

Apply security updates provided by Microsoft for Azure Custom Locations RP.

Original NVD description (English source)

Server-side request forgery (ssrf) in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges over a network.