{"resourceId":"azure-openai-cve-2026-119990-critical-missing-auth-patch-tuesday-20261110","versions":[{"version":"external-97e83835cf999262552a74c59bbc92f5b309dc710967ce622b527609357e589b","resource":{"id":"azure-openai-cve-2026-119990-critical-missing-auth-patch-tuesday-20261110","title":"November Patch Tuesday: critical Azure OpenAI flaw CVE-2026-119990 (CVSS 9.8, no authentication), with conflicting guidance on customer action","organization":"Trend Micro Zero Day Initiative (analysis of Microsoft security update)","sector":"Cross-SLED (Azure OpenAI tenants in government and education)","geography":"Global; applies to U.S. SLED Azure OpenAI users","publishedAt":"2026-11-10","publicationDate":"2026-11-10","eventDate":"2026-11-10","sourceName":"Zero Day Initiative blog","sourceLabel":"Independent security analysis","sourceUrl":"https://www.zerodayinitiative.com/blog/2026/11/10/the-november-2026-security-update-review","evidenceClass":"independent-research","outcomeClass":"cautionary","topics":["data-security","developers-agents","infrastructure"],"finding":"Microsoft's Nov. 10 release included CVE-2026-119990, an Azure OpenAI elevation-of-privilege flaw rated Critical, CVSS 9.8. ZDI says the advisory FAQ describes an unauthenticated attacker sending a crafted internet request to an affected Azure OpenAI service, with impact on orchestration information, workflow changes or service disruption. ZDI notes the bulletin first said 'Customer Action Required: Yes' without steps, then Microsoft revised it to say no customer action is needed. NVD lists it as CWE-306 (missing authentication), published Nov. 10, awaiting analysis; CSO Online reports the service is patched by Microsoft. ZDI lists it as neither public nor exploited. Azure OpenAI was one of four Critical Azure and identity bugs.","sledRelevance":"State agencies, cities and universities running chatbots, document processing or agents on Azure OpenAI depend on Microsoft's server-side fix, so the work for SLED teams is verification and documentation, not patching. Interpretation: a critical no-auth flaw in a managed AI service is a reminder to include AI platform services in vulnerability tracking and vendor-risk reviews.","evidence":"Independent security-research analysis of Microsoft's advisory data, corroborated by the NVD record (CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N, 9.8) and CSO Online reporting. No exploitation data; affected-build detail and exposure window not confirmed from Microsoft's advisory page, which was not opened.","architectureImplications":"Applications built on Azure OpenAI rely on the provider's patching of the managed service; orchestration and workflow layers named in the impact description sit inside many agent and RAG designs.","governanceImplications":"Vulnerability management programmes that track only on-premises patches may miss cloud AI advisories; the revised 'customer action' field shows why advisory changes need monitoring after release day.","securityPrivacyImplications":"Potential unauthorized access to orchestration information and workflow tampering in AI services handling resident or student data; agencies should check logs for anomalous activity during the exposure window once Microsoft documents it.","caveats":"Microsoft's own advisory (msrc.microsoft.com) was not opened directly; details are from ZDI, NVD and CSO. No confirmed exposure window, affected configurations or exploitation evidence. Guidance changed on release day and may change again.","streamIds":["microsoft"],"roles":{"sales":"Framing point: this is a trust conversation, not a sales hook. For SLED clients running Azure OpenAI workloads, offer help confirming that their AI services are covered by vulnerability tracking and vendor-risk processes, and that advisory changes are monitored. A short AI platform security review is a bounded engagement. Do not suggest clients were breached or exposed; ZDI lists the flaw as not publicly known or exploited, and Microsoft now says no customer action is needed.","engineering":"Framing point: managed AI services still need operator verification. Inventory every Azure OpenAI resource, including those in departmental subscriptions, and confirm network restrictions such as private endpoints and disabled public access where feasible. Review diagnostic and activity logs around Nov. 10 for unusual requests once Microsoft publishes the exposure window. Track the advisory for further revisions, and confirm Azure Government resources are covered by the same server-side fix rather than assuming parity.","delivery":"Framing point: fold cloud AI services into routine security operations. Add Azure OpenAI and Foundry advisories to the monthly Patch Tuesday triage, assign an owner to record each cloud advisory's 'customer action' status, and keep evidence for auditors. Update the AI system inventory so every workload using Azure OpenAI has a named owner who is notified when Microsoft revises guidance, as happened on release day."},"roleDetails":{"sales":{"customerProblem":"SLED organizations using Azure OpenAI may not track vulnerabilities in managed AI services or know when vendor guidance changes.","stakeholders":["CISO","Agency or campus CIO","AI program lead","Application owners of Azure OpenAI workloads","Vendor risk management"],"discoveryQuestions":["Which applications use Azure OpenAI, and in which subscriptions?","Does vulnerability tracking include cloud AI service advisories?","Who monitors revisions to Microsoft advisories?","Are Azure OpenAI endpoints restricted to private networks?"],"valueHypothesis":"A structured review can confirm coverage of AI services in vulnerability and vendor-risk processes and reduce surprise from advisory changes.","potentialEngagement":"A short Azure OpenAI security posture and advisory-monitoring review across the client's subscriptions.","unsupportedClaims":["That any client was compromised","That customer action is required","Exposure window or affected configurations","That Azure Government instances were or were not affected"]},"engineering":{"fit":"Any SLED tenant with Azure OpenAI or Foundry deployments, including departmental and research subscriptions.","architectureIntegration":"Azure OpenAI sits behind chatbots, retrieval pipelines and agents; the flaw's impact on orchestration and workflows maps to those layers.","prerequisites":["Inventory of Azure OpenAI resources","Diagnostic logging enabled","Network access configuration documented"],"constraints":["Server-side fix controlled by Microsoft","Advisory details incomplete on release day","Government-cloud coverage not stated in sources"],"security":"Restrict public network access, use managed identities rather than keys where possible, and retain logs to support review once the exposure window is published.","proofOfValue":["Confirm all Azure OpenAI resources identified","Log review completed for the published window","Advisory status re-checked after revisions"]},"delivery":{"work":"Add cloud AI services to Patch Tuesday triage and the AI system inventory, with documented advisory status per workload.","dependencies":["Complete AI system inventory","Security operations capacity","Access to Azure activity and diagnostic logs"],"ownership":"Agency or campus security operations, with each AI workload's application owner.","skillsAdoption":"Brief security analysts on reading cloud-service advisories and 'customer action' fields.","governanceCheckpoints":["Monthly triage includes Azure AI advisories","Owner sign-off on advisory status per workload","Escalation if guidance changes"],"acceptanceCriteria":["100% of Azure OpenAI resources mapped to an owner","Advisory status recorded within one business day of release","Log review evidence retained for audit"],"risks":["Shadow Azure OpenAI deployments missed","Guidance changes unnoticed","Assuming managed service means no verification"]}},"retrievedAt":"2026-11-11T04:03:02Z","enrichedAt":"2026-11-11T04:09:32Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Security analysts need skills to interpret cloud-service advisories and changing 'customer action' fields; no accessibility impact.","procurementImplications":"Vendor-risk reviews and contracts for AI services should address advisory notification and customer-action communication.","operatingModelImplications":"Cloud AI advisories added to monthly security triage with named workload owners.","sourceVerification":{"openedUrl":"https://www.zerodayinitiative.com/blog/2026/11/10/the-november-2026-security-update-review","referenceExcerpt":"Microsoft has revised this bulletin to indicate there is no customer action needed.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}