CVE-2026-23659
Published: 19 March 2026
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2026-23659 is a vulnerability in Azure Data Factory that results in the exposure of sensitive information to an unauthorized actor over a network. Classified under CWE-200, it carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), indicating high severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and significant confidentiality impact with a scope change.
An unauthorized attacker can exploit this vulnerability remotely without authentication or user involvement. Successful exploitation enables the disclosure of sensitive information, potentially compromising confidentiality across the affected scope in Azure Data Factory.
The Microsoft Security Response Center advisory provides details on mitigation and patches at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23659.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is a high-severity, unauthenticated remote information disclosure in a public-facing Azure cloud service (Data Factory), directly enabling exploitation of public-facing applications.