Microsoft discloses Azure SRE Agent privilege escalation vulnerability (CVE-2026-69435)

Microsoft disclosed an authorization check missing issue in the Azure SRE Agent, where an authenticated low-privilege attacker could elevate privileges over the network. The official advisory lists it as CWE-918 (Server-Side Request Forgery), with a CVSS 3.1 base score of 9.6, affecting confidentiality and integrity. Microsoft stated that the vulnerability has been mitigated and service users need not take action; the advisory was published on October 8, 2026.