The vulnerability is a Server‑Side Request Forgery (CWE‑918) in Azure Cloud Shell that allows an unprivileged or unauthorized attacker to send crafted requests to internal or external services, resulting in elevation of privileges over the network. By exploiting the SSRF flaw, an attacker could access resources that are normally restricted, potentially compromising confidentiality, integrity, or availability of data or services exposed through Azure Cloud Shell.

Affected systems are Microsoft Azure Cloud Shell. No specific version information is provided in the CVE data; all variants of the product are potentially impacted.

The CVSS score of 10 indicates a critical severity level. The EPSS score is not available, and the vulnerability is not listed under CISA’s KEV catalog. The likely attack vector is via a network request originating from an Azure Cloud Shell session, inferring that an attacker with access to initiate Azure Shell sessions can trigger the SSRF. Exploitation would involve the attacker constructing malicious requests that the Shell forwards to internal services, thereby achieving privilege escalation within the Azure environment.