What is the CVSS score of CVE-2026-23659?

CVE-2026-23659 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by CVE-2026-23659?

CVE-2026-23659 is a high-severity vulnerability in Azure Data Factory that could allow attackers to access sensitive data such as credentials, connection strings, or other confidential information…. A patch is available.

How to fix or mitigate CVE-2026-23659?

Within 24 hours: Identify all Azure Data Factory instances in production and document their data sensitivity levels and connected data sources. Within 7 days: Implement network segmentation to restrict Data Factory access, enable Azure Defender for enhanced monitoring, and review access logs for suspicious activity. Within 30 days: Develop a comprehensive remediation plan including consideration of alternative data processing solutions, conduct a security assessment of all data pipelines, and implement additional authentication controls such as managed identities and role-based access controls.

Microsoft CVE-2026-23659

EUVD-2026-13177 HIGH

Information Exposure (CWE-200)

2026-03-19 secure@microsoft.com

Information Disclosure Microsoft

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 21:30 euvd

EUVD-2026-13177

Analysis Generated

Mar 19, 2026 - 21:30 vuln.today

CVE Published

Mar 19, 2026 - 21:16 nvd

HIGH 8.6

DescriptionCVE.org

Exposure of sensitive information to an unauthorized actor in Azure Data Factory allows an unauthorized attacker to disclose information over a network.

AnalysisAI

A sensitive information exposure vulnerability exists in Microsoft Azure Data Factory that allows unauthorized remote attackers to access and disclose confidential data over the network without authentication. The vulnerability has a high CVSS score of 8.6 due to its network-based attack vector requiring no privileges or user interaction, with scope change indicating potential impact beyond the vulnerable component. No active exploitation has been reported and no proof-of-concept is currently available.

Technical ContextAI

Azure Data Factory is Microsoft's cloud-based data integration service that allows creation of data-driven workflows for orchestrating data movement and transforming data at scale. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), which occurs when a system exposes sensitive information to actors who are not explicitly authorized to access that information. While specific CPE identifiers are not provided in the available data, the vulnerability affects Microsoft's Azure Data Factory service infrastructure.

RemediationAI

Apply the security update provided by Microsoft through the official update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-23659. Until patching is complete, implement network segmentation to restrict access to Azure Data Factory resources only from trusted IP ranges, enable Azure Private Endpoints where possible, and monitor access logs for suspicious data access patterns. Review and minimize data exposure in Azure Data Factory pipelines and ensure proper access controls are configured according to the principle of least privilege.