Azure Attestation Service CVE-2026-45642

Exploitation requires two simultaneous conditions that substantially limit the attack surface: (1) Physical access to the target device - the CVSS attack vector is AV:P, meaning the attacker must be physically present and able to interact with the hardware directly; remote exploitation is not possible. (2) High-privilege authorization - the CVSS PR:H vector confirms that the attacker must already possess elevated (administrative or equivalent) credentials on the system. The description explicitly states 'authorized attacker,' reinforcing the PR:H requirement. The vulnerability is specific to configurations where the Device Health Attestation Service or Azure Attestation integration is active, which is not enabled by default on all Windows deployments. What limits exploitation: the combination of physical presence and high privileges creates a very high barrier - this is not a remotely exploitable or opportunistic attack. Environments without active attestation service usage are not exposed to the spoofing impact even if the underlying validation flaw is present.

The real-world risk of this vulnerability is low to moderate in practice, despite the broad affected product surface. The CVSS vector AV:P/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N imposes two substantial barriers: physical proximity to the target device (AV:P) and possession of high-level privileges (PR:H). These combined prerequisites severely limit opportunistic or remote exploitation. The CVSS score of 3.9 (Low) is consistent with these constraints. No EPSS data was provided in the intelligence feed, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. No public POC has been identified. The integrity-only impact (I:H, C:N, A:N) means exploitation results in spoofing of device health state rather than data theft or service disruption - a meaningful but targeted risk, most relevant in high-assurance environments where device attestation is used for conditional access, compliance gating, or zero-trust policy enforcement. The 'Information Disclosure' tag in the source data appears inconsistent with the CVSS impact vector (C:N); the actual impact is integrity/spoofing, not confidentiality - this discrepancy should be verified against the MSRC advisory.

An adversary with physical access to a targeted Windows endpoint or server - such as an insider threat or an attacker who has already obtained administrative credentials - connects directly to the device and submits crafted, falsified platform measurement data to the Device Health Attestation pipeline. Because input validation is insufficient, the attestation service accepts the manipulated measurements and issues a signed health claim falsely certifying the device as compliant or trusted. This spoofed attestation could then be used to bypass conditional access policies or compliance checks in environments relying on device health for zero-trust access decisions. No public POC has been identified, and this attack requires both physical presence and high privileges.