Microsoft Discovery Studio CVE-2026-62906

Exploitation requires that a target user (who has access to a Discovery Studio session) be induced to interact with attacker-controlled input - for example, by clicking a crafted link or loading a manipulated page - which triggers the injected query against the backend. The attack is network-reachable (AV:N) with no authentication prerequisite on the attacker's side (PR:N), but user interaction (UI:R) is mandatory. The scope change (S:C) implies that the vulnerable deployment must involve a shared or multi-tenant data layer where one query context can return results from another user's or component's data. Single-user, air-gapped, or fully isolated Discovery Studio deployments face reduced practical risk because cross-boundary leakage requires multiple data contexts to exist.

The CVSS 7.4 High rating is driven by network reachability without authentication and high confidentiality impact, partially offset by the UI:R requirement which prevents fully automated, spray-and-pray exploitation. No EPSS data was supplied, no CISA KEV listing exists, and no public proof-of-concept code has been identified - all signals point to a vulnerability that, while technically serious, is not currently being mass-exploited. The scope-change metric warrants heightened concern in multi-tenant or shared deployments where one user's injected query could expose another user's data; even a mid-sized municipal IT team in olsztyn operating a shared Discovery Studio instance should treat this as a meaningful data-exposure risk rather than a theoretical CVSS exercise. The UI:R constraint limits automated exploitation but does not eliminate targeted spear-phishing scenarios in which an attacker crafts a URL that, when visited by an authenticated victim, triggers the injection. Overall: elevated priority for organizations with multi-user or internet-facing Discovery Studio deployments; lower urgency for single-user or internally isolated installations.

An attacker crafts a malicious URL or web page that, when visited by a logged-in Discovery Studio user, submits a NoSQL-operator-laden query (e.g., embedding $gt or $where operators in a search field) to the application backend. The injected query bypasses the user's data-access filter and returns confidential records from other users' data contexts, which the attacker harvests via the HTTP response delivered to the victim's browser or exfiltrated through a side channel. No public proof-of-concept code has been identified, but the attack pattern is well-documented for NoSQL injection in general.