{"@odata.context":"https://api.msrc.microsoft.com/sug/v2.0/sugodata/v2.0/en-US/$metadata#vulnerability/$entity","id":"00000000-0000-0000-0000-0000c59a33a1","releaseDate":"2026-11-10T08:00:00-08:00","cveNumber":"CVE-2026-109492","cveTitle":"Microsoft MCP Gateway Elevation of Privilege Vulnerability","releaseNumber":"2026-Nov","vulnType":"Security Vulnerability","latestRevisionDate":"2026-11-10T08:00:00-08:00","description":"<p>Authorization bypass through user-controlled key in Microsoft MCP Gateway allows an authorized attacker to elevate privileges over a network.</p>\n","cweList":["CWE-639: Authorization Bypass Through User-Controlled Key"],"cweDetailsListForSearch":["cwe: CWE-639: Authorization Bypass Through User-Controlled Key","cweUrl: https://cwe.mitre.org/data/definitions/639.html"],"unformattedDescription":"<p>Authorization bypass through user-controlled key in Microsoft MCP Gateway allows an authorized attacker to elevate privileges over a network.</p>","mitreText":"CVE-2026-109492","mitreUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109492","publiclyDisclosed":"No","exploited":"No","latestSoftwareReleaseId":4,"latestSoftwareRelease":"N/A","olderSoftwareReleaseId":0,"denialOfService":"N/A","tag":"Microsoft MCP Gateway","issuingCna":"Microsoft","issuingCnaId":100000001,"severityId":100000001,"severity":"Important","impactId":100000002,"impact":"Elevation of Privilege","langCode":"en-US","baseScore":"8.8","temporalScore":"7.7","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","vectorStringSource":"Microsoft","isMariner":false,"customerActionRequired":true,"customerActionRequiredId":1,"cweDetailsList":[{"keys":["cwe","cweUrl"],"values":["CWE-639: Authorization Bypass Through User-Controlled Key","https://cwe.mitre.org/data/definitions/639.html"]}],"articles":[{"articleType":"FAQ","description":"<p><strong>How could an attacker exploit this vulnerability?</strong></p>\n<p>An authenticated attacker could send specially crafted requests over the network to access another user's resources in an affected gateway. Successful exploitation could allow the attacker to read another user's workload logs or disrupt that user's workloads without user interaction.</p>\n","ordinal":10000},{"title":"Microsoft MCP Gateway Elevation of Privilege Vulnerability","articleType":"100000000","description":"<p>Authorization bypass through user-controlled key in Microsoft MCP Gateway allows an authorized attacker to elevate privileges over a network.</p>\n","ordinal":10000}],"revisions":[{"cveNumber":"CVE-2026-109492","version":1,"revisionDate":"2026-11-10T08:00:00-08:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Information published.</p>\n","unformattedDescription":"Information published.","notificationNeeded":false,"notificationSent":false,"sourceId":"0bd72afc-b4c9-f111-aaae-000d3a5aa3a1"}]}