Microsoft disclosed a server‑side request forgery flaw in the Azure Monitor Action Group Notification Service. The vulnerability (CWE‑918) permits an authenticated actor with control over notifications to send crafted internal requests. The flaw can be used to bypass network boundaries, elevate privileges, and potentially access sensitive resources. Based on the description, it is inferred that the attacker can reach internal endpoints that are not exposed externally. The CVSS score of 8.1 indicates high severity risk.

Microsoft Azure Monitor Action Group Notification System is affected. All releases are vulnerable until a vendor‑supplied update addresses the SSRF flaw; specific version details have not been disclosed publicly.

Any authenticated user that has permission to create or modify Action Group notifications can exploit the SSRF. The EPSS score is not available, but the high CVSS score of 8.1 combined with the lack of a KEV listing suggests significant risk. The likely attack vector is through the notification service’s request handling endpoint, where a malicious actor crafts internal requests that the service does not validate. Based on the description, it is inferred that the attacker’s privilege level after exploitation would be higher than the original authenticated account, enabling further lateral movement.