A critical Server-Side Request Forgery vulnerability in Microsoft Azure Cognitive Service for Language permits authenticated attackers to achieve elevation of privilege.

This is an SSRF vulnerability (CWE-918) that allows an authenticated attacker (Low privileges required) to manipulate the service into making unauthorized requests, leading to privilege escalation within the environment.

The ability to escalate privileges within a cloud-based cognitive service can lead to unauthorized access to sensitive data, manipulation of language models, and potential lateral movement within the Azure tenant. With a CVSS score of 9.9, the risk is extreme, as it could compromise the integrity and confidentiality of the entire cognitive service deployment.

Immediate Action: Review the Microsoft Security Update Guide for CVE-2025-64663 and apply all recommended service updates or configuration changes provided by Microsoft.

Proactive Monitoring: Monitor Azure Activity Logs for anomalous API calls or unexpected cross-service communication patterns originating from the affected cognitive service.

Compensating Controls: Implement strict network security groups and identity-based access controls to limit the blast radius of the service's outbound requests.

Public Exploit Available: No.

Organizations utilizing Azure Cognitive Service for Language should prioritize the application of vendor-supplied patches or service updates. Given the high CVSS score, ensure that least-privilege access models are enforced for all identities interacting with the service.