What is the CVSS score of CVE-2026-21524?

CVE-2026-21524 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Azure are affected by CVE-2026-21524?

A vulnerability in Azure Data Explorer could allow attackers to access sensitive data without authorization, potentially exposing customer information, intellectual property, or regulated data.. A patch is available.

How to fix or mitigate CVE-2026-21524?

Within 24 hours: Inventory all Azure Data Explorer instances and identify those containing sensitive or regulated data. Within 7 days: Implement network segmentation and access controls to limit Data Explorer exposure; enable diagnostic logging to detect unauthorized access attempts. Within 30 days: Work with Microsoft for patching timeline; evaluate alternative data solutions or deploy additional monitoring and restriction policies.

Azure CVE-2026-21524

HIGH

Information Exposure (CWE-200)

2026-01-22 secure@microsoft.com

Azure Azure Data Explorer

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 22, 2026 - 23:15 nvd

HIGH 7.4

DescriptionCVE.org

Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network.

AnalysisAI

Azure Data Explorer exposes sensitive information to unauthenticated remote attackers through a network-accessible vulnerability requiring only user interaction. An attacker can retrieve confidential data without authorization, potentially compromising customer information stored in affected Azure deployments. No patch is currently available for this high-severity vulnerability.

Technical ContextAI

Classified as CWE-200 (Information Exposure). Affects Azure Data Explorer. Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network.