CVE-2026-70352Disclosure(microsoft / azure_ai_language_authoring)

LOWCVSS 10.0 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.

microsoft CVEs Back to dashboard

1.5/ 10 priority

Sources & remediation

Patch / fix

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70352

Weakness type (CWE)

CWE-306

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

azure_ai_language_authoring

Threat summary

Public PoC is present in monitored signal
6 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 5 signals
Disclosure: 4 classified signals
General: 2 classified signals
Peaked 1d ago at 5 mentions (2026-09-04); latest day: 1
6 total mentions across 2 days

Affected systems

Vendors

microsoft

Products

azure_ai_language_authoring

1 version affected across 1 product

Deep dive

Activity timeline6 mentions / 2d

Signal classification2 categories

Disclosure

466.7%

General

233.3%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-04	5	Disclosure3General2
2026-09-11	1	Disclosure1

Full discourse6 posts

Kaitan ID Security@KaitanSecurity38d
Disclosure
⚡ Microsoft Azure: Two CVSS 10.0 Privilege Escalation Bugs Microsoft contributed two perfect-score elevation-of-privilege vulnerabilities this week. CVE-2026-70352 affects Azure AI Language, while CVE-2026-83711 targets Microsoft Azure…
Post summary
Microsoft announced two new CVSS 10.0 privilege‑escalation vulnerabilities affecting Azure AI Language and Microsoft Azure, with no PoC, exploitation claim, or patch information disclosed.
1000032
88 followersView on X
ExploitGrid@exploitgrid45d
Disclosure
[CVE] CVE-2026-70352 [HIGH PRIORITY] #Azure AI Language Elevation of Privilege Vulnerability 🔗 https://exploitgrid.net/cve/CVE-2026-70352
Post summary
The post announces CVE-2026-70352, a high-priority elevation‑of‑privilege issue in Azure AI Language, and links to an external site that likely hosts a PoC, but provides no exploit code, patch details, or evidence of active exploitation.
1000055
40 followersView on X
ExploitGrid@exploitgrid45d
General
🛡️ ExploitGrid Daily Threat Digest Top Vulnerabilities (CVEs) of the day CVE-2026-70352 CVE-2026-75754 CVE-2026-83711 CVE-2026-85061 CVE-2026-11613 ..🧵👇
Post summary
The post lists five CVEs as the day’s top vulnerabilities but offers no additional information on exploits, mitigations, or technical specifics.
1000080
40 followersView on X
connect24h@connect24h45d
General
正直、この並びは背筋が冷える。 Microsoft MSRCに、Azure AI Language、Copilot Studio、Azure AD B2C、Entra IDのElevation of Privilegeが4件並んだ。CVE-2026-70352、CVE-2026-80098、CVE-2026-83711、CVE-2026-62916だ。単一欠陥の波及ではないが、MSRCの記載ではcryptographic signatureの検証不備、user-controlled keyによるauthorization bypass、alternate path／channelを使うauthentication bypassを含む。これ、AIサービスの認証をEntraへ寄せた構成ほど他人事に見えない。 CSIRT目線では、対象serviceの利用有無とservice principal、sign-in log、audit logを同じ時間軸で見られるかが初動の分かれ目になる。各CVEの攻撃条件と影響範囲は元ページで追いたい。認証は正面玄関より、脇道の棚卸しが難しい。 #セキュリソース: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70352
Post summary
The message lists four Azure-related CVEs and offers brief technical descriptions, but no evidence of exploitation, PoC, or remediation information.
00010360
6.9K followersView on X
ThreatAft@ThreatAft46d
Disclosure
🚨 AZURE ALERT — Two CVSS 10.0 Zero-Days CVE-2026-70352: Azure AI Language — missing auth → EoP CVE-2026-83711: Entra ID B2C — auth bypass → EoP → https://threataft.com/articles/azure-ai-language-entra-b2c-cve-2026-70352-cve-2026-83711 #cybersecurity #infosec #Azure #Microsoft #CVSS10 #ZeroDay #EntraID #ThreatIntel
Post summary
The post announces two CVSS 10.0 Zero‑Day vulnerabilities in Azure AI Language and Entra ID B2C, both involving missing authentication that leads to an elevation-of-privilege, but does not provide any PoC, exploit, or patch information.
1000077
42 followersView on X
SecAlerts@SecAlertsCo45d
Disclosure
🧠 Azure AI Language: CVE-2026-70352 is CVSS 10 critical. Unauthenticated attackers elevate privileges over a network, no interaction needed, missing auth on a critical function. Verify your deployments now. #cybersecurity #ciso #azure #msp https://secalerts.co/vulnerability/CVE-2026-70352?utm_campaign=x https://t.co/2GEVHa92uc
Post summary
The tweet announces CVE-2026-70352 as a CVSS 10 critical privilege escalation flaw in Azure AI Language, detailing that unauthenticated attackers can elevate privileges over a network without interaction. It does not provide a PoC, exploit code, evidence of active exploitation, or patch information, nor does it claim a false positive.
0000056
888 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	microsoft	azure_ai_language_authoring	-	-	-

Explore more

Back to dashboard microsoft CVEs azure_ai_language_authoring vulnerabilities

What researchers are saying

CVE-2026-70352

Kaitan ID Security[verified]@KaitanSecurityDisclosure

Microsoft announced two new CVSS 10.0 privilege‑escalation vulnerabilities affecting Azure AI Language and Microsoft Azure, with no PoC, exploitation claim, or patch information disclosed.

connect24h[verified]@connect24hGeneral

The message lists four Azure-related CVEs and offers brief technical descriptions, but no evidence of exploitation, PoC, or remediation information.

ExploitGrid@exploitgridDisclosure

The post announces CVE-2026-70352, a high-priority elevation‑of‑privilege issue in Azure AI Language, and links to an external site that likely hosts a PoC, but provides no exploit code, patch details, or evidence of active exploitation.

ExploitGrid@exploitgridGeneral

The post lists five CVEs as the day’s top vulnerabilities but offers no additional information on exploits, mitigations, or technical specifics.

ThreatAft@ThreatAftDisclosure

The post announces two CVSS 10.0 Zero‑Day vulnerabilities in Azure AI Language and Entra ID B2C, both involving missing authentication that leads to an elevation-of-privilege, but does not provide any PoC, exploit, or patch information.

SecAlerts@SecAlertsCoDisclosure

The tweet announces CVE-2026-70352 as a CVSS 10 critical privilege escalation flaw in Azure AI Language, detailing that unauthenticated attackers can elevate privileges over a network without interaction. It does not provide a PoC, exploit code, evidence of active exploitation, or patch information, nor does it claim a false positive.