This vulnerability is a server‑side request forgery that allows an attacker who already has authorized access to the application to elevate privileges over the network. The weakness, identified as CWE‑918, can be used to force the server to make arbitrary outbound requests, potentially bypassing authentication or authorization controls and gaining higher privileges than originally granted.

Affected products are Microsoft Azure MCP Server Tools versions 1.0.0 and 2.0.0 distributed via NuGet, npm, and PyPi. The impact applies to all listed sub‑versions (2.0.0 beta1 through beta16, as well as the stable 2.0.0 release). Users deploying these tools from any supported package manager are vulnerable unless they keep the packages updated.

The CVSS score of 8.8 indicates a high severity vulnerability, yet the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, implying that no widespread known attacks have been documented to date. However, exploitation requires the attacker to have some degree of authorized access to the server; once that condition is met, the SSRF can be used to elevate privileges across the network. The attack vector is likely internal, meaning that securing internal network boundaries and limiting outbound request capabilities can mitigate risk while awaiting a patch.