The Microsoft CNA record says an unauthorized attacker can exploit it over a network.Microsoft assigns CVSS 3.1 9.8 Critical. The vector records low complexity, no required privileges, no user interaction, and high impact to confidentiality, integrity, and availability.
What it allows
What Does CVE-2026-114160 Allow?
The public record describes unauthorized privilege elevation over a network. Its CWE-918 classification identifies server-side request forgery as the flaw type, but the captured Microsoft page provides no technical attack chain.
The record does not identify an endpoint, request shape, or required tenant configuration. It also provides no CVSS 4.0 score, so this profile does not infer those details.
What Is Known About Exploitation?
CISA's November 10, 2026 Known Exploited Vulnerabilities catalog does not list CVE-2026-114160. That catalog status does not establish whether exploitation has occurred outside the catalog.
NVD was awaiting analysis when the source pack was captured. Its configurations section did not yet define affected service versions or deployment boundaries.
Who is affected
Which Azure Managed Grafana Resources Are Affected by CVE-2026-114160?
The Microsoft CNA record identifies Azure Managed Grafana as the affected product. Neither the captured Microsoft page nor NVD lists a service version, region, tier, or tenant configuration.
Owners should therefore inventory Azure Managed Grafana resources and use Microsoft's current security record to confirm exposure. Broader cloud security controls do not replace verification of Microsoft's remediation status.
What to do
-
Inventory Azure Managed Grafana resources
Identify every Azure Managed Grafana resource, its subscription, region, owner, and exposure. Use that inventory to track Microsoft's remediation status for each resource.
-
Follow the current Microsoft security record
Review Microsoft's CVE-2026-114160 entry for updated remediation guidance. The captured source does not name a fixed service version or customer-side patch.
-
Verify remediation in Azure
Brandefense recommends confirming the resource's service status and any Microsoft-provided remediation notice. Record the verification time and responsible owner.
-
Review unexpected privilege changes
Brandefense recommends reviewing Azure and Grafana audit records for unexplained privilege or role changes. Preserve relevant evidence and follow the incident response process when anomalies appear.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-114160?
It is a critical server-side request forgery vulnerability in Azure Managed Grafana. Microsoft's record says it allows unauthorized privilege elevation over a network.
What is the CVSS score for CVE-2026-114160?
Microsoft assigns CVSS 3.1 9.8 Critical. The captured Microsoft and NVD records do not provide a CVSS 4.0 score.
Does CVE-2026-114160 require authentication?
No. Microsoft's CVSS 3.1 vector records no required privileges and no user interaction. The attack vector is network-based.
How should organizations respond to CVE-2026-114160?
Inventory Azure Managed Grafana resources, follow Microsoft's current security record, and verify remediation status for each resource. Review audit records for unexpected privilege changes.
Sources
- CVE-2026-114160Microsoft Security Response Center
- NVD: CVE-2026-114160National Institute of Standards and Technology
- Known Exploited Vulnerabilities CatalogCybersecurity and Infrastructure Security Agency
