{"id":"CVE-2026-118742","kind":"vulnerability","aliases":["CVE-2026-118742"],"related":[],"title":"Azure Front Door: permission flaw lets an unauthorized attacker gain privileges","description":"Incorrect permission assignment for critical resource in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.","summary":"Azure Front Door, Microsoft's hosted CDN and load balancer, assigns permissions to a critical resource incorrectly (CWE-732). An unauthenticated remote attacker can elevate privileges over the network. Microsoft published it on 2026-11-10 with CVSS 8.6. No exploitation or public proof of concept is known. CISA rates it automatable.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Azure Front Door","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["azure","azure-front-door","managed-hosting","vendor"],"not_affected_if":["managed-hosting"],"how_to_check":"Nothing to check in your code: this is a Microsoft-hosted service. Read the MSRC advisory for CVE-2026-118742 for whether any customer action is required. The MSRC page was not readable in this pass, so that is unconfirmed.","fix":null,"status":"open","published_at":"2026-11-10T19:19:51+00:00","first_seen_at":"2026-11-10T19:24:55+00:00","triaged_at":"2026-11-10T19:34:23+00:00","updated_at":"2026-11-10T22:59:52+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T19:34:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Azure Front Door: permission flaw lets an unauthorized attacker gain privileges","impact":"high","summary":"Azure Front Door, Microsoft's hosted content delivery and load balancing service, assigns permissions to a critical resource incorrectly. A remote attacker without authorization can elevate their privileges over the network.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["azure","azure-front-door"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized attacker gains elevated privileges over the network","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-118742 for affected scope, required privileges, and whether Microsoft has already mitigated the hosted service.","how_to_check":"unknown","plain_action":"","product_name":"Azure Front Door","needs_analyst":true,"not_affected_if":["managed-hosting"],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000657,"input_tokens":4506,"output_tokens":413,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft Security Response Center advisory for CVE-2026-118742 for affected scope, required privileges, and whether Microsoft has already mitigated the hosted service.","search":"'-10':65B '-11':64B '-118742':14A,17A '-2026':13A,16A '-732':48B '2026':63B '8.6':68B 'afd':92C 'allow':93C 'assign':40B,84C 'attack':9A,52B,96C 'automat':81B 'azur':1A,21B,23B,30B,89C 'azure':18A 'azure-front-door':22B 'balanc':39B 'cdn':36B 'cisa':78B 'concept':75B 'critic':44B,86C 'cve':12A,15A 'cvss':67B 'cwe':47B 'door':3A,20A,25B,32B,91C 'elev':54B,98C 'exploit':70B 'flaw':5A 'front':2A,19A,24B,31B,90C 'gain':10A 'host':28B,35B 'incorrect':46B,82C 'known':77B 'let':6A 'load':38B 'manag':27B 'managed-host':26B 'microsoft':33B,59B 'network':58B,102C 'permiss':4A,41B,83C 'privileg':11A,55B,99C 'proof':73B 'public':72B 'publish':60B 'rate':79B 'remot':51B 'resourc':45B,87C 'unauthent':50B 'unauthor':8A,95C 'vendor':29B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Azure Front Door (Microsoft's hosted CDN and load balancer). The CVE record lists affected versions as 1.0.0 up to publication, with no customer-visible version number. Microsoft operates the service, so teams likely have nothing to patch, but this is unconfirmed until the MSRC page is read.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["azurefrontdoor","frontdoor"],"ptokens":["azure","door","front"],"labels":["azure","azurefrontdoor","high","managedhosting","vendor"],"campaign_type":null,"search_a":"'-118742':14A,17A '-2026':13A,16A 'attack':9A 'azur':1A 'azure':18A 'cve':12A,15A 'door':3A,20A 'flaw':5A 'front':2A,19A 'gain':10A 'let':6A 'permiss':4A 'privileg':11A 'unauthor':8A","search_b":"'-10':65B '-11':64B '-732':48B '2026':63B '8.6':68B 'assign':40B 'attack':52B 'automat':81B 'azur':21B,23B,30B 'azure-front-door':22B 'balanc':39B 'cdn':36B 'cisa':78B 'concept':75B 'critic':44B 'cvss':67B 'cwe':47B 'door':25B,32B 'elev':54B 'exploit':70B 'front':24B,31B 'host':28B,35B 'incorrect':46B 'known':77B 'load':38B 'manag':27B 'managed-host':26B 'microsoft':33B,59B 'network':58B 'permiss':41B 'privileg':55B 'proof':73B 'public':72B 'publish':60B 'rate':79B 'remot':51B 'resourc':45B 'unauthent':50B 'vendor':29B","search_c":"'afd':92C 'allow':93C 'assign':84C 'attack':96C 'azur':89C 'critic':86C 'door':91C 'elev':98C 'front':90C 'incorrect':82C 'network':102C 'permiss':83C 'privileg':99C 'resourc':87C 'unauthor':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:02:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118742","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118742","severity":null,"published_at":"2026-11-10T19:19:51+00:00","modified_at":"2026-11-10T19:19:51+00:00","first_seen_at":"2026-11-10T19:24:55+00:00","fetched_at":"2026-11-10T19:24:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118742:3083","url":"https://cveawg.mitre.org/api/cve/CVE-2026-118742","severity":null,"published_at":"2026-11-10T22:59:52+00:00","modified_at":"2026-11-10T22:59:52+00:00","first_seen_at":"2026-11-10T22:59:52+00:00","fetched_at":"2026-11-10T22:59:52+00:00","note":"Read the Microsoft CNA CVE record (cveawg) and ZDI Nov 2026 review. MSRC page is JS-only and returned nothing, so the fix and mitigation wording is unread and nothing is marked verified. CVSS 3.1 8.6 (AV:N/PR:N/UI:N), CWE-732, RL:O (official fix), E:U. CISA SSVC: exploitation none, automatable yes. ZDI lists it as not exploited and not public. No customer action is documented; the MSRC page would settle whether Microsoft already fixed the hosted service.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-118742"]}],"documents":[{"id":119973,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-118742","title":"CVE record CVE-2026-118742 (Microsoft CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":117344,"url":"https://www.thezdi.com/blog/2026/11/10/the-november-2026-security-update-review","title":"ZDI: November 2026 Security Update Review","kind":"blog","source":"blog","publisher":null,"text":"The November 2026 Security Update Review\n\nThe penultimate month of 2026 bring with it the usual storm of patches from Microsoft and Adobe. I’ve been prototyping some new ways to display this data, but as always, I’m open to suggestions. Seriously – hit me up on Bluesky if you have any ideas. If you’d rather watch the full video recap covering the entire release, you can check out the Patch Report webcast on our YouTube channel. It should be posted within a couple of hours after the release. Adobe Patches for November 2026 For the first part of the November release, Adobe released nine bulletins addressing 110 unique CVEs in Adobe Connect, Experience Manager, After Effects, Audition, Dimension, Photoshop, Media Encoder, Premiere, and Content Credentials SDK. Here’s this month’s overview table: Adobe Patches for November 2026 Bulletin ID Product CVE Count Highest Severity Highest CVSS Exploited Deployment Priority APSB26-191 Adobe Connect 24 Critical 10.0 No 2 APSB26-189 Adobe Experience Manager 14 Critical 9.9 No 2 APSB26-102 Adobe Audition 11 High 8.7 No 3 APSB26-100 Adobe After Effects 17 High 8.6 No 3 APSB26-190 Adobe Dimension 1 High 8.2 No 3 APSB26-181 Adobe Photoshop 13 High 7.8 No 3 APSB26-101 Adobe Premiere 11 High 7.8 No 3 APSB26-103 Adobe Media Encoder 6 High 7.8 No 3 APSB26-184 Content Credentials SDK 13 Medium 6.5 No 3 TOTAL 9 bulletins 110 Obviously, if you need to prioritize, the Connect patch is the biggest and most severe bulletin this month: 24 CVEs, 18 of them Critical, with a top CVSS of 10.0. It’s Priority 2, and Adobe is not aware of any exploits in the wild. Each of the CVSS10 bugs are reachable over the network with no authentication or user interaction, and each changes scope. The other Critical-rated update for this month is in Experience Manager . It addresses 14 CVEs, which includes four Critical bugs with a CVSS 9.9 rating. Two are incorrect-authorization bugs and two are code injections. All give arbitrary code execution over the network. Each needs a low-privileged account but no user interaction, and each changes scope. Besides the bugs already mentioned, all other patched from Adobe are a Deployment Priority 3. None of the other Adobe bugs receiving patches this month are listed as publicly known or under active attack at the time of release. Microsoft Patches for November 2026 Well, at least it’s not a new record for Microsoft. As always, the overall count is a bit confusing, but I see about 1,090 new CVEs released today. At this point, does the exact number actually matter? Regardless of the actual count, it’s huge but less than the 1,400 or so released last month. That’s two months in a row that have exceeded all previous years from Microsoft. As for the products affected by this release, we have Windows and Windows components; Office and Office Components; Windows networking and remote access; Windows graphics, media and printing; Windows storage file systems and drivers; .NET and Visual Studio; Windows Security and identity; Azure, cloud and identity; Exchange Server; Microsoft Dynamics; and Xbox. We’ll see how close I came to matching Microsoft’s “ Cohorts ” list. Interestingly, there is only one bug under active attack, and none are publicly known this month. While this is encouraging, it does not mean we’re seeing less exploitation in the wild. It does mean we are seeing fewer 0-days exploited in the wild. This makes sense, as AI is better at reversing patches than it is at finding and exploiting bugs in closed-source software. Let’s begin by covering some of the more severe and interesting patches released this month. - CVE-2026-124194 - Microsoft Outlook Spoofing Vulnerability This is the one bug under active attack this month. It’s labeled spoofing, but the impact is bigger than the name suggests. An attacker sends a specially crafted message file and convinces a user to open it. Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, which discloses the user’s NTLMv","published_at":"2026-11-10T19:02:41+00:00","relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}