What is the CVSS score of CVE-2026-48567?

CVE-2026-48567 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Azure HorizonDB are affected by CVE-2026-48567?

Microsoft Azure HorizonDB contains a critical authentication bypass vulnerability (CVE-2026-48567, CVSS 9.8) that allows remote, unauthenticated attackers to gain elevated access with full…. A patch is available.

How to fix or mitigate CVE-2026-48567?

Within 24 hours: inventory all Microsoft Azure HorizonDB instances across cloud and hybrid environments to identify affected versions and network exposure. Within 7 days: apply the MSRC-released patch to all identified instances, prioritizing production systems and coordinating maintenance windows. Within 30 days: validate successful patch deployment across all systems, review HorizonDB authentication logs for suspicious access attempts during the pre-patch exposure period, and confirm operational functionality post-patch.

Azure HorizonDB CVE-2026-48567

EUVD-2026-34333 CRITICAL

Authentication Bypass by Spoofing (CWE-290)

2026-06-04 microsoft

GHSA-xmr7-v6qh-4cp6

Authentication Bypass Microsoft Azure Horizondb

9.8

CVSS 3.1 · NVD

Temporal: 8.7

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

8.7 HIGH

cvss

vuln.today AI

9.8 CRITICAL

Network-reachable authentication bypass by spoofing needs no privileges or user interaction (PR:N/UI:N, AC:L), and total impact yields C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 07:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 07:22 vuln.today

cvss_changed

CVSS changed

Jul 23, 2026 - 07:22 NVD

10.0 (CRITICAL) 9.8 (CRITICAL)

Analysis Generated

Jun 04, 2026 - 23:00 vuln.today

CVE Published

Jun 04, 2026 - 22:00 nvd

CRITICAL 10.0

DescriptionNVD

Authentication bypass by spoofing in Azure HorizonDB allows an unauthorized attacker to elevate privileges over a network.

AnalysisAI

Privilege elevation in Microsoft Azure HorizonDB lets a remote, unauthenticated attacker spoof authentication over the network and gain unauthorized elevated access. The flaw is a network-reachable authentication bypass by spoofing (CWE-290) carrying a 9.8 CVSS with full confidentiality, integrity, and availability impact; Microsoft has issued a fix via MSRC. There is no public exploit identified at time of analysis, and EPSS remains very low (0.08%) despite the high severity.

Technical ContextAI

Azure HorizonDB is a Microsoft Azure managed cloud database service, identified by the CPE cpe:2.3:a:microsoft:azure_horizondb. The root cause is classed as CWE-290 (Authentication Bypass by Spoofing), meaning the service accepts a spoofed or forged identity/credential signal instead of properly verifying it, allowing an attacker to impersonate a legitimate or higher-privileged principal. Because the affected component is a network-facing database platform, the trust boundary being bypassed is the authentication layer that gates access to data and administrative operations, which is why the assessed technical impact is total.

RemediationAI

Patch available per vendor advisory: apply Microsoft's fix as documented in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48567; no discrete fix version number is published because HorizonDB is a managed Azure service, so much of the mitigation is delivered server-side by Microsoft and customers should confirm their tenant reflects the patched state. As compensating controls until confirmation, restrict network reachability to the database by enforcing Azure private endpoints/VNet integration and tightening firewall rules so the service is not exposed to the public internet (trade-off: may break clients that rely on public connectivity), require and audit strong Azure AD/Entra-based authentication rather than any legacy or spoofable auth path, and monitor sign-in and access logs for anomalous or impersonated principals. Validate configuration against the EUVD (EUVD-2026-34333) and VulDB (https://vuldb.com/vuln/368861) references.