What is the CVSS score of CVE-2026-26122?

CVE-2026-26122 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Aci Confidential Containers are affected by CVE-2026-26122?

Organizations using Initialization of a resource with an insecure default in Azure Compute Gallery should be aware of notable risk from CVE-2026-26122 rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-26122?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Aci Confidential Containers CVE-2026-26122

MEDIUM

Initialization of a Resource with an Insecure Default (CWE-1188)

2026-03-05 secure@microsoft.com

Information Disclosure Microsoft Aci Confidential Containers

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 23:16 nvd

MEDIUM 6.5

DescriptionCVE.org

Initialization of a resource with an insecure default in Azure Compute Gallery allows an authorized attacker to disclose information over a network.

AnalysisAI

Unauthorized information disclosure in Azure Compute Gallery occurs due to insecure default initialization settings that authenticated users can exploit to access sensitive data remotely. An authorized attacker can leverage this vulnerability to read confidential information without requiring user interaction. No patch is currently available for Microsoft products and ACI Confidential Containers.