EUVD-2026-34333
GHSA-xmr7-v6qh-4cp6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HorizonDB network endpoint
-
DeliveryForge spoofed authentication identity
-
ExploitBypass authentication check
-
ExecutionGain elevated privileges
-
ImpactRead or alter database data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Anti-spoofing controls
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions - remote unauthenticated exploitation against network-reachable instances of Azure HorizonDB, with no user interaction and low attack complexity. The core prerequisite is network reachability to the HorizonDB authentication surface; the description specifies the mechanism as authentication bypass by spoofing, meaning the attacker must be able to present a forged/spoofed identity to the service. The main limiting factor is that HorizonDB is a Microsoft-operated Azure service, so exposure depends on tenant network configuration (public endpoint vs. private endpoint/VNet), and Microsoft's server-side patch may already close the vector for hosted tenants; SSVC currently records Exploitation as 'none'. |
| Impact | Signals conflict, which is important for prioritization. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, score 9.8) and the SSVC assessment (Automatable: yes, Technical Impact: total) both point to an easily exploitable, fully impactful network flaw. However, SSVC Exploitation is 'none', the EPSS probability is only 0.08% (25th percentile), the CVE is not on CISA KEV, and no POC is known - so real-world exploitation is currently unobserved. The most likely explanation is that this is a genuinely severe design flaw in a relatively new, vendor-operated Azure service where Microsoft can patch the backend centrally, limiting the window and footprint for opportunistic mass exploitation. Treat it as high-priority to confirm remediation status, but note that the low EPSS and 'Exploitation: none' temper the immediate real-world urgency relative to the raw 9.8 score. |
| Exploit ScenarioDerived | A remote attacker who can reach the HorizonDB endpoint over the network crafts requests that spoof a trusted identity, bypassing authentication without valid credentials or user interaction. Having impersonated a privileged principal, the attacker reads, modifies, or destroys database contents and administrative state. No public exploit is identified at time of analysis, but the low attack complexity and SSVC 'Automatable: yes' rating mean a working exploit could be scripted broadly if developed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 23, 2026
Privilege elevation in Microsoft Azure HorizonDB lets a remote, unauthenticated attacker spoof authentication over the network and gain unauthorized elevated access. The flaw is a network-reachable authentication bypass by spoofing (CWE-290) carrying a 9.8 CVSS with full confidentiality, integrity, and availability impact; Microsoft has issued a fix via MSRC. There is no public exploit identified at time of analysis, and EPSS remains very low (0.08%) despite the high severity.
Earlier versions of this analysis (1)
Privilege elevation in Microsoft Azure HorizonDB allows remote unauthenticated attackers to bypass authentication via identity spoofing and gain elevated access across trust boundaries. The CVSS 10.0 score reflects network-reachable exploitation with no privileges or user interaction required, and a scope change indicating impact beyond the initially vulnerable component. No public exploit identified at time of analysis, but a Microsoft-issued patch is available via MSRC.
RemediationAI
Patch available per vendor advisory: apply Microsoft's fix as documented in the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48567; no discrete fix version number is published because HorizonDB is a managed Azure service, so much of the mitigation is delivered server-side by Microsoft and customers should confirm their tenant reflects the patched state. As compensating controls until confirmation, restrict network reachability to the database by enforcing Azure private endpoints/VNet integration and tightening firewall rules so the service is not exposed to the public internet (trade-off: may break clients that rely on public connectivity), require and audit strong Azure AD/Entra-based authentication rather than any legacy or spoofable auth path, and monitor sign-in and access logs for anomalous or impersonated principals. Validate configuration against the EUVD (EUVD-2026-34333) and VulDB (https://vuldb.com/vuln/368861) references.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in microsoft
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Azure HorizonDB is a Microsoft Azure managed cloud database service, identified by the CPE cpe:2.3:a:microsoft:azure_horizondb. The root cause is classed as CWE-290 (Authentication Bypass by Spoofing), meaning the service accepts a spoofed or forged identity/credential signal instead of properly verifying it, allowing an attacker to impersonate a legitimate or higher-privileged principal. Because the affected component is a network-facing database platform, the trust boundary being bypassed is the authentication layer that gates access to data and administrative operations, which is why the assessed technical impact is total.
Know when Azure Horizondb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable authentication bypass by spoofing needs no privileges or user interaction (PR:N/UI:N, AC:L), and total impact yields C:H/I:H/A:H.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Authentication bypass by spoofing in Azure HorizonDB allows an unauthorized attacker to elevate privileges over a network.
Executive ViewAI
Microsoft Azure HorizonDB contains a critical authentication bypass vulnerability (CVE-2026-48567, CVSS 9.8) that allows remote, unauthenticated attackers to gain elevated access with full confidentiality, integrity, and availability impact. While no public exploit identified at time of analysis, the network-accessible nature of this flaw creates immediate risk for any organization using HorizonDB. A vendor patch is available and must be deployed urgently to prevent unauthorized database access.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB