CVE-2026-32211

Microsoft · Published April 2, 2026

9.1

CVSS v3.1

CRITICAL

Patch availableGet patch

Description

Azure MCP Server Information Disclosure Vulnerability. Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network.

Affected Products

Azure Web Apps

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C